CVE-2019-12419

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-12419
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12419.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-12419
Aliases
Published
2019-11-06T21:15:11.243Z
Modified
2026-07-08T05:54:49.416186452Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:commerce_guided_search",
            "extracted_events": [
                {
                    "introduced": "11.3.2"
                },
                {
                    "last_affected": "11.3.2"
                }
            ]
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.1.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:enterprise_manager_base_platform",
            "extracted_events": [
                {
                    "introduced": "13.2.1.0"
                },
                {
                    "last_affected": "13.2.1.0"
                }
            ]
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:flexcube_private_banking",
            "extracted_events": [
                {
                    "introduced": "12.0.0"
                },
                {
                    "last_affected": "12.0.0"
                },
                {
                    "introduced": "12.1.0"
                },
                {
                    "last_affected": "12.1.0"
                }
            ]
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:retail_order_broker",
            "extracted_events": [
                {
                    "introduced": "15.0"
                },
                {
                    "last_affected": "15.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/cxf

Affected ranges

Type
GIT
Repo
https://github.com/apache/cxf
Events
Introduced
f5ee3b786e22a081121eeebbba6d02fa9f4e7206
Fixed
da2d27d97f9e9abd7d307e2224e5e0338b767ee2
Introduced
8f90e00177d464541e99ed61238cbc52cff0846d
Fixed
fbd2dbf5fecbac7343b9fe442a10e75cfb9f7471
Database specific 
{
    "cpe": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.11"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.4"
        }
    ]
}

Affected versions

cxf-3.*
cxf-3.2.0
cxf-3.2.1
cxf-3.2.10
cxf-3.2.2
cxf-3.2.3
cxf-3.2.4
cxf-3.2.5
cxf-3.2.6
cxf-3.2.7
cxf-3.2.8
cxf-3.2.9
cxf-3.3.0
cxf-3.3.1
cxf-3.3.2
cxf-3.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12419.json"