CVE-2017-7661: Apache CXF Fediz CSRF Vulnerability
Summary
CVE-2017-7661: Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. Affects org.apache.cxf.fediz:fediz-spring2 across 2 version ranges.
< 1.2.4
>= 1.3.0, < 1.3.2
Fixed in 1.2.4 or 1.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF Fediz is an open-source library that provides WS-Federation support for applications. It includes container-specific plugins for different frameworks, such as Spring and Jetty. These plugins enable WS-Federation functionality in applications. However, prior to versions 1.4.0, 1.3.2, and 1.2.4, there is a moderate severity CSRF vulnerability in the Spring 2, Spring 3, Jetty 8, and Jetty 9 plugins.
Vulnerability Detail
The CSRF vulnerability in Apache CXF Fediz allows for Cross-Site Request Forgery attacks. This means that an attacker can trick a user into performing unintended actions on a vulnerable application. The vulnerability affects the Spring 2, Spring 3, Jetty 8, and Jetty 9 plugins. The impact of this vulnerability can vary depending on the actions that can be performed through the vulnerable application. It is important to upgrade to the fixed versions to mitigate this vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.2.41.2.4 -
>= 1.3.0, < 1.3.21.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The CSRF vulnerability in Apache CXF Fediz can be mitigated by upgrading to the fixed versions. It is important to keep your dependencies up to date to ensure the security of your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.cxf.fediz:fediz-spring2 →
FAQ
Apache CXF Fediz is an open-source library that provides WS-Federation support for applications. It includes container-specific plugins for different frameworks.
A CSRF (Cross-Site Request Forgery) vulnerability allows an attacker to trick a user into performing unintended actions on a vulnerable application.
The Spring 2, Spring 3, Jetty 8, and Jetty 9 plugins in Apache CXF Fediz are affected by this vulnerability.
The impact of this vulnerability can vary depending on the actions that can be performed through the vulnerable application.
To fix this vulnerability, upgrade to Apache CXF Fediz versions 1.4.0, 1.3.2, or 1.2.4.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf.fediz:fediz-spring2.
