org.apache.cxf.fediz.examples:spring2webapp (>=1.1.0, <=1.3.2), org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring2 (>=1.2.0, <=1.3.2) +2 more potentially affected by CVE-2017-12631 via org.apache.cxf.fediz:fediz-spring2 (>=1.1.0, <=1.3.2)

org.apache.cxf.fediz:fediz-spring2 MAVEN version =1.1.0, =1.1.0, =1.2.0, =1.1.0, =1.1.0, =1.3.2 Source cves: CVE-2017-12631 Source advisory: MEND:CVE-2017-12631...

org.apache.cxf.fediz.systests.webapps:fediz-systests-webapps-spring3 (>=1.4.0, <=1.4.2), org.apache.cxf.fediz:apache-fediz (>=1.4.1, <=1.4.2) potentially affected by CVE-2017-12631 via org.apache.cxf.fediz:fediz-spring3 (>=1.4.0, <=1.4.2)

org.apache.cxf.fediz:fediz-spring3 MAVEN version =1.4.0, =1.4.0, =1.4.1, =1.4.2 Source cves: CVE-2017-12631 Source advisory: MEND:CVE-2017-12631...

org.apache.cxf.fediz:apache-fediz (>=1.0.0, <=1.1.2) potentially affected by CVE-2015-5175 via org.apache.cxf.fediz:fediz-idp (>=1.0.0, <=1.1.2)

org.apache.cxf.fediz:fediz-idp MAVEN version =1.0.0, =1.0.0, =1.1.2 Source cves: CVE-2015-5175 Source advisory: MEND:CVE-2015-5175...

Cross-site Request Forgery (CSRF)

Apache Fediz is vulnerable to cross-site request forgery CSRF attacks. The attack happens when a client starts the authentication process and does not complete it for example when the IdP is unavailable, leading to a security context set up using a malicious client's roles for the given enduser...

org.apache.cxf.fediz:apache-fediz (1.3.1) potentially affected by CVE-2017-7662 via org.apache.cxf.fediz:fediz-oidc (1.3.1)

org.apache.cxf.fediz:fediz-oidc MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf.fediz:fediz-oidc and may be impacted: - org.apache.cxf.fediz:apache-fediz 1.3.1 Source cves: CVE-2017-7662 Source advisory:...

org.apache.cxf.fediz:apache-fediz (>=1.3.0, <=1.3.1) potentially affected by CVE-2017-7661 via org.apache.cxf.fediz:fediz-jetty8 (>=1.3.0, <=1.3.1)

org.apache.cxf.fediz:fediz-jetty8 MAVEN version =1.3.0, =1.3.0, =1.3.1 Source cves: CVE-2017-7661 Source advisory: MEND:CVE-2017-7661...