Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means

Summary

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

Timeline

1. Apr 18, 2017, 4:00 PM UTCCVE published
2. Aug 5, 2024, 3:11 PM UTCRecord last updated

Affected versions

• Apache Software Foundation Apache CXF

  3.1.x before 3.1.11, versions before 3.0.13

• org.apache.cxf:cxf-coreMaven

  From 3.1.0 · fixed in 3.1.11

• org.apache.cxf:cxf-coreMaven

  fixed in 3.0.13

References 11