CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2017-5656
High (7.5) in apache cxf. EPSS 6.8% chance of exploitation in the next 30 days. Fixed in org.apache.cxf:cxf-core 3.0.13, 3.1.11.
Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.
Severity
- EPSS
- 6.8% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-384
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cxf
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v936-x3j5-c76j | Maven | org.apache.cxf:cxf-core | >=3.1.0 <3.1.11 | 3.1.11 |
| GHSA-v936-x3j5-c76j | Maven | org.apache.cxf:cxf-core | <3.0.13 | 3.0.13 |