PT-2019-4665 · Apache · Apache Cxf
Publicado
2019-11-06
·
Atualizado
2021-06-17
·
CVE-2019-12419
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Apache CXF versions prior to 3.3.4 and 3.2.11
Description
The issue is related to the OpenId Connect service in Apache CXF, where the access token service does not properly validate the authenticated principal against the supplied
clientId parameter in the request. This could allow a malicious client to exploit the vulnerability and obtain an access token for another client if they can steal an authorization code. The vulnerability is associated with weaknesses in the authentication procedure, which can be exploited by a remote attacker to gain unauthorized access to protected information.Recommendations
For versions prior to 3.3.4 and 3.2.11, update to version 3.3.4 or 3.2.11 or later to resolve the issue.
As a temporary workaround, consider restricting access to the OpenId Connect service to minimize the risk of exploitation.
Exploit
Correção
Incorrect Authorization
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Apache Cxf