org.apache.cxf.fediz:apache-fediz (1.3.1) potentially affected by CVE-2017-7662 via org.apache.cxf.fediz:fediz-oidc (1.3.1)

org.apache.cxf.fediz:fediz-oidc MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf.fediz:fediz-oidc and may be impacted: - org.apache.cxf.fediz:apache-fediz 1.3.1 Source cves: CVE-2017-7662 Source advisory:...

CVE-2017-7662

Apache CXF Fediz’s OpenID Connect Client Registration Service is vulnerable to CSRF in versions prior to 1.4.0 and 1.3.2. A malicious web app could create new clients or reset secrets after an admin logs in and the session remains active. The connected sources corroborate the same description acr...