CVE-2019-12419
cxf: OpenId Connect token service does not properly validate the clientId
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
Apache CXF versiones anteriores a la versión 3.3.4 y 3.2.11, provee todos los componentes necesarios para construir un servicio OpenId Connect completamente desarrollado. Existe una vulnerabilidad en los servicios de token de acceso, donde no comprueba que el principal autenticado sea igual al del parámetro clientId proporcionado en la petición. Si un cliente malicioso fue capaz de robar de alguna manera un código de autorización emitido a otro cliente, podría explotar esta vulnerabilidad para obtener un token de acceso para el otro cliente.
A flaw was found in cxf in versions prior to 3.2.11 and 3.3.4. The access token services do not properly validate that an authenticated principal is equal to that of the supplied clientId parameter allowing a malicious client to use an authorization code that has been issued to a different client as their own. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-05-28 CVE Reserved
- 2019-11-06 CVE Published
- 2024-08-04 CVE Updated
- 2024-10-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-287: Improper Authentication
- CWE-863: Incorrect Authorization
CAPEC
References (16)
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.oracle.com/security-alerts/cpuApr2021.html | 2023-11-07 | |
https://www.oracle.com/security-alerts/cpuapr2020.html | 2023-11-07 | |
https://www.oracle.com/security-alerts/cpujan2020.html | 2023-11-07 | |
https://www.oracle.com/security-alerts/cpuoct2020.html | 2023-11-07 |
URL | Date | SRC |
---|---|---|
http://cxf.apache.org/security-advisories.data/CVE-2019-12419.txt.asc | 2023-11-07 | |
https://access.redhat.com/security/cve/CVE-2019-12419 | 2020-07-28 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1816175 | 2020-07-28 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Apache Search vendor "Apache" | Cxf Search vendor "Apache" for product "Cxf" | >= 3.2.0 < 3.2.11 Search vendor "Apache" for product "Cxf" and version " >= 3.2.0 < 3.2.11" | - |
Affected
| ||||||
Apache Search vendor "Apache" | Cxf Search vendor "Apache" for product "Cxf" | >= 3.3.0 < 3.3.4 Search vendor "Apache" for product "Cxf" and version " >= 3.3.0 < 3.3.4" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Commerce Guided Search Search vendor "Oracle" for product "Commerce Guided Search" | 11.3.2 Search vendor "Oracle" for product "Commerce Guided Search" and version "11.3.2" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Enterprise Manager Base Platform Search vendor "Oracle" for product "Enterprise Manager Base Platform" | 13.2.1.0 Search vendor "Oracle" for product "Enterprise Manager Base Platform" and version "13.2.1.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Flexcube Private Banking Search vendor "Oracle" for product "Flexcube Private Banking" | 12.0.0 Search vendor "Oracle" for product "Flexcube Private Banking" and version "12.0.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Flexcube Private Banking Search vendor "Oracle" for product "Flexcube Private Banking" | 12.1.0 Search vendor "Oracle" for product "Flexcube Private Banking" and version "12.1.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Retail Order Broker Search vendor "Oracle" for product "Retail Order Broker" | 15.0 Search vendor "Oracle" for product "Retail Order Broker" and version "15.0" | - |
Affected
|