GCVE - cpe:2.3:a:apache:cxf_fediz:1.4.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:cxf_fediz:1.4.0:*:*:*:*:*:*:*

part: a version: 1.4.0 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Cxf Fediz (`c26f5c39-eb0a-5f7c-ae7e-2ed7390fdc14`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/cxf`	purl2cpe	2026-06-01 10:14:23.788292
`pkg:github/apache/cxf`	purl2cpe	2026-06-01 10:14:23.788294
`pkg:github/apache/cxf-fediz`	purl2cpe	2026-06-01 10:14:23.788295

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7662`	vulnerable	2026-06-08 05:10:05.721181	Details available Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in this web application in Apache CXF Fediz prior to 1.4.0 and 1.3.2, meaning that a malicious web application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registration service and the session is still active. Published: 2017-05-16T17:00:00.000Z Updated: 2024-08-05T16:12:27.730Z Open on db.gcve.eu Reference links http://cxf.apache.org/security-advisories.data/CVE-2017-7662.txt.asc http://www.securitytracker.com/id/1038498 https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-12631`	vulnerable	2026-06-08 05:08:47.417524	Details available Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a security context that is set up using a malicious client's roles for the given enduser. Published: 2017-11-30T14:00:00.000Z Updated: 2024-09-16T21:58:27.297Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1040487 http://www.securityfocus.com/bid/102127 http://cxf.547215.n5.nabble.com/Apache-CXF-Fediz-1-4-3-and-1-3-3-released-with-a-new-security-advisory-CVE-2017-12631-td5785868.html https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.