Access token validation errors affects all versions of Apache CXF prior to 3.3.4 and 3.2.11.

Free Trial

Access token validation errors affects all versions of Apache CXF prior to 3.3.4 and 3.2.11.

http://marionjensen.com/2005/01 Overview :

Apache CXF OpenId Connect token service does not properly validate the clientId

http://venturearchitecture.com/live/albion-street Affected Product(s) :

Apache CXF prior to 3.3.4 and 3.2.11.

Vulnerability Details :

CVE ID :

CVE-2019-12419

Apache CXF provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied

If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

Solution :

Users of Apache CXF that rely on the OpenId Connect service should update to either the 3.3.4 or 3.2.11 releases.

Access token validation errors affects all versions of Apache CXF prior to 3.3.4 and 3.2.11.

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2024-22144 : ELI SCHEETZ ANTI-MALWARE SECURITY AND BRUTE-FORCE FIREWALL PLUGIN CODE INJECTION

CVE-2024-26922 : LINUX KERNEL UP TO 6.9-RC4 AMDGPU PRIVILEGE ESCALATION

CVE-2024-21511 : MYSQL2 UP TO 3.9.6 READCODEFOR TIMEZONE CODE INJECTION