Skip to main content

CVE-2019-12419

Severity

8.1

Description

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

Related links:

Project

Apache TomEE

Category
Apache CXF OpenId Connect token service does not properly validate the clientId
Tags
data
Date Disclosed

2019-11-06

Date Discovered

2019-05-28

Apache TomEE 8.0.x

First release:
2019-09-13
CVEs:
88
Support Lifecycle:
Namespace:
javax
8.0.0

Apache TomEE 7.1.x

First release:
2018-09-02
CVEs:
81
Support Lifecycle:
Namespace:
javax
7.1.07.1.17.1.27.1.37.1.4

Apache TomEE 7.0.x

First release:
2016-05-17
CVEs:
111
Support Lifecycle:
Namespace:
javax
7.0.07.0.17.0.27.0.37.0.47.0.57.0.67.0.77.0.87.0.9

Apache TomEE 1.7.x

First release:
2014-08-09
CVEs:
95
Support Lifecycle:
Namespace:
javax
1.7.01.7.11.7.21.7.31.7.41.7.5

Apache TomEE 1.6.x

First release:
2013-11-17
CVEs:
108
Support Lifecycle:
Namespace:
javax
1.6.01.6.0.11.6.0.2

Apache TomEE 1.5.x

First release:
2012-09-28
CVEs:
119
Support Lifecycle:
Namespace:
javax
1.5.01.5.11.5.2
Feel Vulnerable? 

Contact us so we can help you.

* These fields are required.