Access token validation errors affects all versions of Apache CXF prior to 3.3.4 and 3.2.11.

Free Trial

Access token validation errors affects all versions of Apache CXF prior to 3.3.4 and 3.2.11.

Overview :

Apache CXF OpenId Connect token service does not properly validate the clientId

Affected Product(s) :

Apache CXF prior to 3.3.4 and 3.2.11.

Vulnerability Details :

CVE ID :

CVE-2019-12419

Apache CXF provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied

If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

Solution :

Users of Apache CXF that rely on the OpenId Connect service should update to either the 3.3.4 or 3.2.11 releases.

Access token validation errors affects all versions of Apache CXF prior to 3.3.4 and 3.2.11.

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2024-48889 : FORTINET FORTIMANAGER UP TO 6.4.14/7.0.12/7.2.7/7.4.4/7.6.0 FGFM REQUEST OS COMMAND INJECTION

CVE-2023-34990 : FORTINET FORTIWLM UP TO 8.5.4/8.6.5 WEB REQUEST PATH TRAVERSAL

CVE-2024-47104 : IBM I 7.4/7.5 PHYSICAL FILE SECURITY ATTRIBUTES PERMISSION ASSIGNMENT