Auth bypass in Apache Cxf
CVE-2019-12419
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
Vulnerability class: Broken Access Control
EPSS: 0.138 (96.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Cxf — versions versions before 3.3.4 and 3.2.11
- Apache Cxf
- Oracle Commerce_guided_search — versions 11.3.2
- Oracle Enterprise_manager_base_platform — versions 13.2.1.0
- Oracle Flexcube_private_banking — versions 12.0.0, 12.1.0
- Oracle Retail_order_broker — versions 15.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (Patch, Third Party Advisory, x_refsource_MISC)
- security@apache.org (Patch, Third Party Advisory, x_refsource_MISC)
- security@apache.org (Patch, Third Party Advisory, x_refsource_MISC)
- security@apache.org (x_refsource_CONFIRM, Vendor Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2019-12419?
- CVE-2019-12419 is a critical-severity vulnerability in Apache Cxf, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2019-11-06.
- How severe is CVE-2019-12419?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-12419 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.