CVE-2019-12419
published 2019-11-06CVE-2019-12419: Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability…
critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | apache_cxf | — | — |
| apache | cxf | >= 3.2.0 < 3.2.11 | 3.2.11 |
| apache | cxf | >= 3.3.0 < 3.3.4 | 3.3.4 |
| oracle | commerce_guided_search | — | — |
| oracle | enterprise_manager_base_platform | — | — |
| oracle | flexcube_private_banking | — | — |
| oracle | flexcube_private_banking | — | — |
| oracle | retail_order_broker | — | — |