GHSA-whw7-h25v-9qvx

Suggest an improvement
Source
https://github.com/advisories/GHSA-whw7-h25v-9qvx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-whw7-h25v-9qvx/GHSA-whw7-h25v-9qvx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-whw7-h25v-9qvx
Aliases
Published
2018-10-18T16:56:38Z
Modified
2023-11-08T03:59:25.598320Z
Summary
Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, and org.apache.cxf.fediz:fediz-spring2
Details

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4.

References

Affected packages

Maven / org.apache.cxf.fediz:fediz-spring2

Package

Name
org.apache.cxf.fediz:fediz-spring2
View open source insights on deps.dev
Purl
pkg:maven/org.apache.cxf.fediz/fediz-spring2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.3.0
Fixed
1.3.2

Affected versions

1.*

1.3.0
1.3.1

Maven / org.apache.cxf.fediz:fediz-spring2

Package

Name
org.apache.cxf.fediz:fediz-spring2
View open source insights on deps.dev
Purl
pkg:maven/org.apache.cxf.fediz/fediz-spring2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.4

Affected versions

1.*

1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.2.1
1.2.2
1.2.3

Maven / org.apache.cxf.fediz:fediz-jetty9

Package

Name
org.apache.cxf.fediz:fediz-jetty9
View open source insights on deps.dev
Purl
pkg:maven/org.apache.cxf.fediz/fediz-jetty9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.2

Affected versions

1.*

1.3.0
1.3.1

Maven / org.apache.cxf.fediz:fediz-jetty8

Package

Name
org.apache.cxf.fediz:fediz-jetty8
View open source insights on deps.dev
Purl
pkg:maven/org.apache.cxf.fediz/fediz-jetty8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.2

Affected versions

1.*

1.3.0
1.3.1