CVE-2019-12419
06.11.2019, 21:15
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.Enginsight
| Vendor | Product | Version |
|---|---|---|
| apache | cxf | 3.2.0 ≤ 𝑥 < 3.2.11 |
| apache | cxf | 3.3.0 ≤ 𝑥 < 3.3.4 |
| oracle | commerce_guided_search | 11.3.2 |
| oracle | enterprise_manager_base_platform | 13.2.1.0 |
| oracle | flexcube_private_banking | 12.0.0 |
| oracle | flexcube_private_banking | 12.1.0 |
| oracle | retail_order_broker | 15.0 |
𝑥
= Vulnerable software versions
References