CVE-2017-7662

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-7662
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7662.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-7662
Aliases
Published
2017-05-16T17:29:00.497Z
Modified
2026-07-08T16:53:40.369819Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in this web application in Apache CXF Fediz prior to 1.4.0 and 1.3.2, meaning that a malicious web application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registration service and the session is still active.

References

Affected packages

Git / github.com/apache/cxf-fediz

Affected ranges

Type
GIT
Repo
https://github.com/apache/cxf-fediz
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7aff8635b4078fe952c63306e4ebb4ace25302df
Introduced
6e171f4ec2949188707ecbb9892d4b1bc2eb8aff
Last affected
6e171f4ec2949188707ecbb9892d4b1bc2eb8aff
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:apache:cxf_fediz:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:cxf_fediz:1.4.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.3.2"
        },
        {
            "introduced": "1.4.0"
        },
        {
            "last_affected": "1.4.0"
        }
    ]
}

Affected versions

1.*
1.4.0
fediz-1.*
fediz-1.2.0
fediz-1.3.0
fediz-1.3.1
fediz-1.3.2
fediz-1.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7662.json"