NetSight
IP …
high7.5

CVE-2017-5656

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker co…

Impact

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

Affected products

VendorProductAffected versions
ApacheCxf
from 3.0.0 before 3.0.13
from 3.1.0 before 3.1.11

Weakness classification

CWE-384

References