CVE-2019-12419: Critical severity Apache CXF vulnerability
A flaw was found in cxf in versions prior to 3.2.11 and 3.3.4. The access token services do not properly validate that an authenticated principal is equal to that of the supplied clientId parameter allowing a malicious client to use an authorization code that has been issued to a different client as their own. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cxfto a version that resolves this vulnerability.Fixed in 3.3.4 - Upgrade
Upgrade
redhat/cxfto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.3.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-12419?
CVE-2019-12419 is a vulnerability in cxf versions prior to 3.2.11 and 3.3.4 that allows unauthenticated attackers to pass an access token service validation by supplying a client ID parameter.
How severe is CVE-2019-12419?
CVE-2019-12419 has a severity rating of 9.8 out of 10, indicating it is critical.
Which software versions are affected by CVE-2019-12419?
CVE-2019-12419 affects Apache CXF versions up to 3.2.11 and 3.3.4, Oracle Commerce Guided Search 11.3.2, Oracle Enterprise Manager Base Platform 13.2.1.0, Oracle FLEXCUBE Private Banking 12.0.0 and 12.1.0, and Oracle Retail Order Broker 15.0.
How can I fix the CVE-2019-12419 vulnerability?
To fix the CVE-2019-12419 vulnerability, upgrade Apache CXF to version 3.2.11 or 3.3.4.
Where can I find more information about CVE-2019-12419?
You can find more information about CVE-2019-12419 in the official Apache CXF security advisories, Red Hat Bugzilla, and Red Hat support policy updates.