CVE-2019-12419
Critical
Description
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Apache Cxf
PublishedNov 6, 2019
First seenNov 6, 2019
How to fix
Update
- apache cxf3.2.11, 3.3.4 or later
- org.apache.cxf:cxf3.2.11, 3.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cxf | 3.2.0 ≤ v < 3.2.11, 3.3.0 ≤ v < 3.3.4 | 3.2.11, 3.3.4 |
| oracle commerce_guided_search | 11.3.2 | — |
| oracle enterprise_manager_base_platform | 13.2.1.0 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle retail_order_broker | 15.0 | — |
| org.apache.cxf:cxfMaven | v < 3.2.11, 3.3.0 ≤ v < 3.3.4 | 3.2.11, 3.3.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.