CVE-2019-12419: apache apache cxf Incorrect Authorization
Vulnerability summary
CVE-2019-12419 is a critical (CVSS 9.8) Incorrect Authorization vulnerability in apache apache cxf. EPSS estimates a 13.84% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities.
Timeline
- 06-11-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
13.84%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 13.84% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Oracle4 products
- commerce_guided_search11.3.2
- enterprise_manager_base_platform13.2.1.0
- flexcube_private_banking12.0.0 | 12.1.0
- retail_order_broker15.0
Apache2 products
- apache cxfversions before 3.3.4 and 3.2.11
- cxf≥ 3.2.0, < 3.2.11 | ≥ 3.3.0, < 3.3.4
Org.apache.cxf1 product
- cxf< 3.2.11 | ≥ 3.3.0, < 3.3.4
3 vendors · 7 products
