CVE-2017-5656

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker…

published April 18, 2017

CVSS
—
EPSS
7%
Percentile
94.0
In the wild
Unconfirmed
What it is

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06827 · 94.0th percentile
Published
2017-04-18T16:00Z
EPSS history
Timeline
  • 18 APR 16:00Z
    Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker…
    cvelistv5