CVE-2017-5656
Fixed upstream EPSS 7%
Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.
Products: Apache Software Foundation Apache CXF
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.cxf:cxf-core | 3.1.11 |
| Maven | org.apache.cxf:cxf-core | 3.0.13 |