Apache CXF Fediz CVE-2017-7662 Cross Site Request Forgery Vulnerability

Bugtraq ID:	98485
Class:	Input Validation Error
CVE:	CVE-2017-7662
Remote:	Yes
Local:	No
Published:	May 16 2017 12:00AM
Updated:	May 16 2017 12:00AM
Credit:	The vendor reported the issue.
Vulnerable:	Apache CXF Fediz 1.3.1 Apache CXF Fediz 1.3 Apache CXF Fediz 1.2.3 Apache CXF Fediz 1.2.1 Apache CXF Fediz 1.2 Apache CXF Fediz 1.1.3 Apache CXF Fediz 1.1.2 Apache CXF Fediz 1.1.1 Apache CXF Fediz 1.1 Apache CXF Fediz 1.2.2
Not Vulnerable:	Apache CXF Fediz 1.4 Apache CXF Fediz 1.3.2

Apache CXF Fediz CVE-2017-7662 Cross Site Request Forgery Vulnerability

Apache CXF Fediz is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

Versions prior to Apache CXF Fediz 1.4.0 and 1.3.2 are vulnerable.

Apache CXF Fediz CVE-2017-7662 Cross Site Request Forgery Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache CXF Fediz CVE-2017-7662 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache CXF Fediz CVE-2017-7662 Cross Site Request Forgery Vulnerability

References:

• Apache CXF Fediz - Homepage (Apache)
  
• CVE-2017-7662: The Apache CXF Fediz OIDC Client Registration Service is vulnerab (Apache)