CVSS 3.0
8.8 highCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2017-12631
High (8.8) in apache cxf fediz. EPSS 1.6% chance of exploitation in the next 30 days. Fixed in org.apache.cxf.fediz:fediz-spring2 1.3.3, 1.4.3.
Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a security context that is set up using a malicious client's roles for the given enduser.
Severity
- EPSS
- 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cxf_fediz
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fv7x-4hpc-hf9f | Maven | org.apache.cxf.fediz:fediz-spring2 | <1.3.3 | 1.3.3 |
| GHSA-fv7x-4hpc-hf9f | Maven | org.apache.cxf.fediz:fediz-spring2 | >=1.4.0 <1.4.3 | 1.4.3 |
| GHSA-fv7x-4hpc-hf9f | Maven | org.apache.cxf.fediz:fediz-spring3 | <1.3.3 | 1.3.3 |
| GHSA-fv7x-4hpc-hf9f | Maven | org.apache.cxf.fediz:fediz-spring3 | >=1.4.0 <1.4.3 | 1.4.3 |
| GHSA-fv7x-4hpc-hf9f | Maven | org.apache.cxf.fediz:fediz-spring | <1.3.3 | 1.3.3 |
| GHSA-fv7x-4hpc-hf9f | Maven | org.apache.cxf.fediz:fediz-spring | >=1.4.0 <1.4.3 | 1.4.3 |
References
- http://cxf.547215.n5.nabble.com/Apache-CXF-Fediz-1-4-3-and-1-3-3-released-with-a-new-security-advisory-CVE-2017-12631-td5785868.html
- http://www.securityfocus.com/bid/102127
- http://www.securitytracker.com/id/1040487
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E