CVE-2017-7662
HighSummary
A CSRF vulnerability has been identified in the OpenId Connect client registration service in Apache CXF Fediz prior to versions 1.4.0 and 1.3.2. A malicious web application could create new clients or reset secrets after an admin user has logged into the client registration service.
Risk Assessment
This vulnerability could lead to unauthorized access to client registration functions, posing a threat to the security of the system and the organization's data.
Recommendation
It is recommended to update Apache CXF Fediz to versions 1.4.0 or 1.3.2 to mitigate this vulnerability and implement additional protections against CSRF attacks.
Other vulnerabilities in Apache CXF Fediz
See all- CVE-2015-5175High
Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
- CVE-2017-7661High
A CSRF vulnerability has been found in the Spring 2, Spring 3, Jetty 8, and Jetty 9 plugins in Apache CXF Fediz prior to versions 1.4.0, 1.3.2, and 1.2.4. This flaw may allow attackers to perform unauthorized actions on behalf of users.
- CVE-2016-4464Critical
The application plugins in Apache CXF Fediz versions 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to bypass intended restrictions via a crafted SAML token with a trusted signature.
Original NVD description (English source)
Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in this web application in Apache CXF Fediz prior to 1.4.0 and 1.3.2, meaning that a malicious web application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registration service and the session is still active.