Cross-Site Request Forgery in Apache CXF Fediz
High severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Dec 22, 2023
Description
Published by the National Vulnerability Database
May 16, 2017
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Nov 1, 2022
Last updated
Dec 22, 2023
Credits
-
q5438722 Analyst
Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in this web application in Apache CXF Fediz prior to 1.4.0 and 1.3.2, meaning that a malicious web application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registration service and the session is still active.
References