Apache CXFs STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cxf | Apache | 3.0.0 (including) | 3.0.13 (excluding) |
| Cxf | Apache | 3.1.0 (including) | 3.1.11 (excluding) |
| Red Hat JBoss A-MQ 6.3 | RedHat | cxf | * |
| Red Hat JBoss Fuse 6.3 | RedHat | cxf | * |
| Red Hat Openshift Application Runtimes | RedHat | * |
Such a scenario is commonly observed when: