Apache CXF Fediz CVE-2017-7661 Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	98489
Class:	Input Validation Error
CVE:	CVE-2017-7661
Remote:	Yes
Local:	No
Published:	May 16 2017 12:00AM
Updated:	May 16 2017 12:00AM
Credit:	The vendor reported the issue.
Vulnerable:	Apache CXF Fediz 1.3.1 Apache CXF Fediz 1.3 Apache CXF Fediz 1.2.3 Apache CXF Fediz 1.2.1 Apache CXF Fediz 1.2 Apache CXF Fediz 1.1.3 Apache CXF Fediz 1.1.2 Apache CXF Fediz 1.1.1 Apache CXF Fediz 1.1 Apache CXF Fediz 1.2.2
Not Vulnerable:	Apache CXF Fediz 1.4 Apache CXF Fediz 1.3.2 Apache CXF Fediz 1.2.4

Apache CXF Fediz CVE-2017-7661 Multiple Cross Site Request Forgery Vulnerabilities

Apache CXF Fediz is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

Versions prior to Apache CXF Fediz 1.4.0, 1.3.2 and 1.2.4 are vulnerable.

Apache CXF Fediz CVE-2017-7661 Multiple Cross Site Request Forgery Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache CXF Fediz CVE-2017-7661 Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache CXF Fediz CVE-2017-7661 Multiple Cross Site Request Forgery Vulnerabilities

References:

• Apache CXF Fediz - Homepage (Apache)
  
• CVE-2017-7661: The Apache CXF Fediz Jetty and Spring plugins are vulnerable to C (Apache)