CVE-2019-12419

CWE-863 — Incorrect AuthorizationCWE-287 — Improper Authentication9 documents7 sources
Severity
9.8CRITICAL
EPSS
11.0%
top 6.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Apache CXFApache Apache CXFOracle Commerce Guided Search+3 more
Timeline
PublishedNov 6
Latest updateApr 15

Description

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other clien…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages7 packages

▶NVDapache/cxf3.2.0 — 3.2.11+1
▶Mavenorg.apache.cxf:cxf3.3.0 — 3.3.4+1
▶CVEListV5apache/apache_cxfversions before 3.3.4 and 3.2.11

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
OSV
Potential session hijack in Apache CXF↗2019-11-08
▶
GHSA
Potential session hijack in Apache CXF↗2019-11-08
▶
CVEList
CVE-2019-12419: Apache CXF before 3↗2019-11-06
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Core (Apache CXF) — CVE-2019-12419↗2020-04-15
▶
Oracle
Oracle Oracle Retail Applications Risk Matrix: Order Broker Foundation (CXF) — CVE-2019-12419↗2020-01-15
▶
Red Hat
cxf: OpenId Connect token service does not properly validate the clientId↗2019-11-06
▶

💬Community

2
Bugzilla
CVE-2019-12419 cxf: OpenId Connect token service does not properly validate the clientId↗2020-03-23
▶
Bugzilla
CVE-2019-12419 cxf: OpenId Connect token service does not properly validate the clientId [fedora-all]↗2020-03-23
▶
CVE-2019-12419 (CRITICAL CVSS 9.8) | Apache CXF before 3.3.4 and 3.2.11 | cvebase.io