GHSA-WHW7-H25V-9QVX Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, and org.apache.cxf.fediz:fediz-spring2

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4...

Cross-Site Request Forgery(CSRF)

Apache Fediz Spring Plugin is vulnerable to cross-site request forgery CSRF attacks. The attacks are possible because the application does not properly check the session state of a HTTP request, allowing a malicious user to take the roles of other end users...