Session Fixation Affecting org.apache.cxf:cxf-rt-ws-security package, versions [,3.0.14) [3.1.0,3.1.11)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
21 May 2017
18 Apr 2017
org.apache.cxf:cxf-rt-ws-security is an open source services framework.
Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.