Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully
    fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not
    validate that the authenticated principal is equal to that of the supplied clientId parameter in the
    request. If a malicious client was able to somehow steal an authorization code issued to another client,
    then they could exploit this vulnerability to obtain an access token for the other client.
    (CVE-2019-12419)

ID	Name	Product	Family	Severity
422130	SCA: security update for org.apache.cxf:cxf (GHSA-cw6w-q88j-6mqf)	Tenable Cloud Security	SCA Checks	critical
422130	SCA: security update for org.apache.cxf:cxf (GHSA-cw6w-q88j-6mqf)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2019-12419

critical

Tenable Plugins

critical

critical