description: Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.
problem types: Apache CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens.
affected:
{
product: Apache CXF
vendor: Apache Software Foundation
versions:
status: affected, version: 3.1.x before 3.1.11
status: affected, version: versions before 3.0.13
}