org.apache.cxf.fediz.examples:spring2webapp (>=1.4.0, <=1.4.2), org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring2 (>=1.4.0, <=1.4.2) +1 more potentially affected by CVE-2017-12631 via org.apache.cxf.fediz:fediz-spring2 (>=1.4.0, <=1.4.2)

org.apache.cxf.fediz:fediz-spring2 MAVEN version =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.2 Source cves: CVE-2017-12631 Source advisory: GHSA-FV7X-4HPC-HF9F...

org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring3 (>=1.4.0, <=1.4.2), org.apache.cxf.fediz:apache-fediz (>=1.4.1, <=1.4.2) potentially affected by CVE-2017-12631 via org.apache.cxf.fediz:fediz-spring3 (>=1.4.0, <=1.4.2)

org.apache.cxf.fediz:fediz-spring3 MAVEN version =1.4.0, =1.4.0, =1.4.1, =1.4.2 Source cves: CVE-2017-12631 Source advisory: OSV:GHSA-FV7X-4HPC-HF9F...

org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring3 (>=1.4.0, <=1.4.2), org.apache.cxf.fediz:apache-fediz (>=1.4.1, <=1.4.2) potentially affected by CVE-2017-12631 via org.apache.cxf.fediz:fediz-spring3 (>=1.4.0, <=1.4.2)

org.apache.cxf.fediz:fediz-spring3 MAVEN version =1.4.0, =1.4.0, =1.4.1, =1.4.2 Source cves: CVE-2017-12631 Source advisory: GHSA-FV7X-4HPC-HF9F...

org.apache.cxf.fediz.examples:spring2webapp (1.3.0), org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring2 (1.3.0) +1 more potentially affected by CVE-2016-4464 via org.apache.cxf.fediz:fediz-spring2 (1.3.0)

org.apache.cxf.fediz:fediz-spring2 MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf.fediz:fediz-spring2 and may be impacted: - org.apache.cxf.fediz.examples:spring2webapp 1.3.0 -...

org.apache.cxf.fediz.examples:springpreauthwebapp (>=1.2.0, <=1.2.2), org.apache.cxf.fediz.examples:springwebapp (>=1.2.0, <=1.2.2) +3 more potentially affected by CVE-2016-4464 via org.apache.cxf.fediz:fediz-spring (>=1.2.0, <=1.2.2)

org.apache.cxf.fediz:fediz-spring MAVEN version =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.2 Source cves: CVE-2016-4464 Source advisory: GHSA-QPWJ-MVV7-V3M9...

org.apache.cxf.fediz.examples:springpreauthwebapp (>=1.2.0, <=1.2.2), org.apache.cxf.fediz.examples:springwebapp (>=1.2.0, <=1.2.2) +3 more potentially affected by CVE-2016-4464 via org.apache.cxf.fediz:fediz-spring (>=1.2.0, <=1.2.2)

org.apache.cxf.fediz:fediz-spring MAVEN version =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.2 Source cves: CVE-2016-4464 Source advisory: OSV:GHSA-QPWJ-MVV7-V3M9...

org.apache.cxf.fediz:apache-fediz (>=1.0.0, <=1.1.2) potentially affected by CVE-2015-5175 via org.apache.cxf.fediz:fediz-idp (>=1.0.0, <=1.1.2)

org.apache.cxf.fediz:fediz-idp MAVEN version =1.0.0, =1.0.0, =1.1.2 Source cves: CVE-2015-5175 Source advisory: GHSA-3357-829X-M9PR...

org.apache.cxf.fediz:apache-fediz (1.2.0) potentially affected by CVE-2015-5175 via org.apache.cxf.fediz:fediz-idp (1.2.0)

org.apache.cxf.fediz:fediz-idp MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf.fediz:fediz-idp and may be impacted: - org.apache.cxf.fediz:apache-fediz 1.2.0 Source cves: CVE-2015-5175 Source advisory:...

org.apache.cxf.fediz:apache-fediz (1.2.0) potentially affected by CVE-2015-5175 via org.apache.cxf.fediz:fediz-idp (1.2.0)

org.apache.cxf.fediz:fediz-idp MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf.fediz:fediz-idp and may be impacted: - org.apache.cxf.fediz:apache-fediz 1.2.0 Source cves: CVE-2015-5175 Source advisory:...

org.apache.cxf.fediz:apache-fediz (>=1.3.0, <=1.4.3) potentially affected by CVE-2018-8038 via org.apache.cxf.fediz:fediz-jetty9 (>=1.3.0, <=1.4.3)

org.apache.cxf.fediz:fediz-jetty9 MAVEN version =1.3.0, =1.3.0, =1.4.3 Source cves: CVE-2018-8038 Source advisory: GHSA-W3GH-G32M-CVHR...

org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring3 (>=1.4.0, <=1.4.3), org.apache.cxf.fediz:apache-fediz (>=1.4.1, <=1.4.3) potentially affected by CVE-2018-8038 via org.apache.cxf.fediz:fediz-spring3 (>=1.4.0, <=1.4.3)

org.apache.cxf.fediz:fediz-spring3 MAVEN version =1.4.0, =1.4.0, =1.4.1, =1.4.3 Source cves: CVE-2018-8038 Source advisory: OSV:GHSA-W3GH-G32M-CVHR...

org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring3 (>=1.4.0, <=1.4.3), org.apache.cxf.fediz:apache-fediz (>=1.4.1, <=1.4.3) potentially affected by CVE-2018-8038 via org.apache.cxf.fediz:fediz-spring3 (>=1.4.0, <=1.4.3)

org.apache.cxf.fediz:fediz-spring3 MAVEN version =1.4.0, =1.4.0, =1.4.1, =1.4.3 Source cves: CVE-2018-8038 Source advisory: GHSA-W3GH-G32M-CVHR...

org.apache.cxf.fediz:apache-fediz (>=1.3.0, <=1.4.3) potentially affected by CVE-2018-8038 via org.apache.cxf.fediz:fediz-jetty8 (>=1.3.0, <=1.4.3)

org.apache.cxf.fediz:fediz-jetty8 MAVEN version =1.3.0, =1.3.0, =1.4.3 Source cves: CVE-2018-8038 Source advisory: GHSA-W3GH-G32M-CVHR...

org.apache.cxf.fediz.examples:spring2webapp (>=1.3.0, <=1.3.1), org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring2 (>=1.3.0, <=1.3.1) +1 more potentially affected by CVE-2017-7661 via org.apache.cxf.fediz:fediz-spring2 (>=1.3.0, <=1.3.1)

org.apache.cxf.fediz:fediz-spring2 MAVEN version =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.1 Source cves: CVE-2017-7661 Source advisory: OSV:GHSA-WHW7-H25V-9QVX...

org.apache.cxf.fediz.examples:spring2webapp (>=1.3.0, <=1.3.1), org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring2 (>=1.3.0, <=1.3.1) +1 more potentially affected by CVE-2017-7661 via org.apache.cxf.fediz:fediz-spring2 (>=1.3.0, <=1.3.1)

org.apache.cxf.fediz:fediz-spring2 MAVEN version =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.1 Source cves: CVE-2017-7661 Source advisory: GHSA-WHW7-H25V-9QVX...

org.apache.cxf.fediz:apache-fediz (>=1.3.0, <=1.3.1) potentially affected by CVE-2017-7661 via org.apache.cxf.fediz:fediz-jetty9 (>=1.3.0, <=1.3.1)

org.apache.cxf.fediz:fediz-jetty9 MAVEN version =1.3.0, =1.3.0, =1.3.1 Source cves: CVE-2017-7661 Source advisory: OSV:GHSA-WHW7-H25V-9QVX...

org.apache.cxf.fediz:apache-fediz (>=1.3.0, <=1.3.1) potentially affected by CVE-2017-7661 via org.apache.cxf.fediz:fediz-jetty9 (>=1.3.0, <=1.3.1)

org.apache.cxf.fediz:fediz-jetty9 MAVEN version =1.3.0, =1.3.0, =1.3.1 Source cves: CVE-2017-7661 Source advisory: GHSA-WHW7-H25V-9QVX...

org.apache.cxf.fediz:apache-fediz (>=1.3.0, <=1.4.3) potentially affected by CVE-2018-8038 via org.apache.cxf.fediz:fediz-jetty9 (>=1.3.0, <=1.4.3)

org.apache.cxf.fediz:fediz-jetty9 MAVEN version =1.3.0, =1.3.0, =1.4.3 Source cves: CVE-2018-8038 Source advisory: MEND:CVE-2018-8038...

org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring3 (>=1.4.0, <=1.4.3), org.apache.cxf.fediz:apache-fediz (>=1.4.1, <=1.4.3) potentially affected by CVE-2018-8038 via org.apache.cxf.fediz:fediz-spring3 (>=1.4.0, <=1.4.3)

org.apache.cxf.fediz:fediz-spring3 MAVEN version =1.4.0, =1.4.0, =1.4.1, =1.4.3 Source cves: CVE-2018-8038 Source advisory: MEND:CVE-2018-8038...

Cross-Site Request Forgery(CSRF)

Apache Fediz Spring Plugin is vulnerable to cross-site request forgery CSRF attacks. The attacks are possible because the application does not properly check the session state of a HTTP request, allowing a malicious user to take the roles of other end users...