Auth bypass in Apache Cxf
CVE-2019-12419
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.138 (96.5th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.138 · newest: 0.138 · change: 0.000
Affected products
- Apache Cxf — versions versions before 3.3.4 and 3.2.11
- Apache Cxf
- Oracle Commerce Guided Search — versions 11.3.2
- Oracle Enterprise Manager Base Platform — versions 13.2.1.0
- Oracle Flexcube Private Banking — versions 12.0.0, 12.1.0
- Oracle Retail Order Broker — versions 15.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0… (mailing-list)
- lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d… (mailing-list)
- lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740… (mailing-list)
- www.oracle.com/security-alerts/cpuapr2020.html (Patch, Third Party Advisory)
- www.oracle.com/security-alerts/cpujan2020.html (Patch, Third Party Advisory)
- www.oracle.com/security-alerts/cpuoct2020.html (Patch, Third Party Advisory)
- cxf.apache.org/security-advisories.data/CVE-2019-12419.txt.asc (Vendor Advisory)
- lists.apache.org/thread.html/ree5fc719e330f82ae38a2b0050c91f18ed5b878312dc0b9e0… (mailing-list)
- lists.apache.org/thread.html/r861eb1a9e0250e9150215b17f0263edf62becd5e20fc96251… (mailing-list)
- lists.apache.org/thread.html/re7593a274ee0a85d304d5d42c66fc0081c94d7f22bc96a108… (mailing-list)
Frequently asked questions
- What is CVE-2019-12419?
- CVE-2019-12419 is a critical-severity vulnerability in Apache Cxf, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2019-11-06.
- How severe is CVE-2019-12419?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-12419 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.