Incorrect authorization in Apache CXF
Priority MEDIUM 57CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
Why it matters now
EPSS 0.13836 96th percentileScored 2026-11-07
Fix Partial org.apache.cxf:cxf (Maven): 3.2.11, 3.3.4Red Hat: 3 advisoriesRed Hat: 3 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache CXF | versions before 3.3.4 and 3.2.11 | — | No fix listed | CNA |
| — | org.apache.cxf:cxf (Maven) | before 3.2.11 | 3.2.11 | Patch available | GHSA-cw6w-q88j-6mqf |
| — | org.apache.cxf:cxf (Maven) | 3.3.0 to before 3.3.4 | 3.3.4 | Patch available | GHSA-cw6w-q88j-6mqf |
- Apache CXF VendorApache Affected versions before 3.3.4 and 3.2.11 Fixed in — No fix listed CNA
- org.apache.cxf:cxf (Maven) Vendor— Affected before 3.2.11 Fixed in 3.2.11 Patch available GHSA-cw6w-q88j-6mqf
- org.apache.cxf:cxf (Maven) Vendor— Affected 3.3.0 to before 3.3.4 Fixed in 3.3.4 Patch available GHSA-cw6w-q88j-6mqf
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* | 3.2.0 to before 3.2.11; 3.3.0 to before 3.3.4 | Vulnerable | Apache |
| cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* | 11.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.1.0:*:*:*:*:*:*:* | 13.2.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* | 12.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* Versions 3.2.0 to before 3.2.11; 3.3.0 to before 3.3.4 Vulnerable ·Apache
- cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.1.0:*:*:*:*:*:*:* Versions 13.2.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-cw6w-q88j-6mqf org.apache.cxf:cxf (Maven) Fixed in 3.2.11 Advisory →
- Fix · GHSA-cw6w-q88j-6mqf org.apache.cxf:cxf (Maven) Fixed in 3.3.4 Advisory →
Red Hat 3 advisories
- RHSA-2020:3192 Released 2020-07-28 · Red Hat rating ImportantRed Hat Fuse 7.7.0 release and security update
- Red Hat Fuse 7.7.0
- RHSA-2020:2333 Released 2020-05-28 · Red Hat rating ImportantEAP Continuous Delivery Technical Preview Release 19 security update
- EAP-CD 19 Tech Preview
- RHSA-2020:2067 Released 2020-05-18 · Red Hat rating ImportantRed Hat build of Thorntail 2.5.1 security and bug fix update
- Text-Only RHOAR
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| EAP-CD 19 Tech Preview | Fixed | RHSA-2020:2333 |
| Red Hat Fuse 7.7.0 | Fixed | RHSA-2020:3192 |
| Text-Only RHOAR | Fixed | RHSA-2020:2067 |
Not affected: 6 products
- Logging Subsystem for Red Hat OpenShift
- Red Hat Decision Manager 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
- Red Hat support for Spring Boot
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12419
- 2026-10-03 Alias added: GHSA-cw6w-q88j-6mqf
References
Patch 4
Advisory 2
Other 18
- [cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html
- [cxf-dev] 20201030 CVE-2019-12419
- [cxf-dev] 20201102 Re: CVE-2019-12419
- [cxf-dev] 20201103 Re: CVE-2019-12419
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r861eb1a9e0250e9150215b17f0263edf62becd5e20fc96251cff59f6@%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/re7593a274ee0a85d304d5d42c66fc0081c94d7f22bc96a1084d43b80@%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/ree5fc719e330f82ae38a2b0050c91f18ed5b878312dc0b9e0b9815be@%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
More Apache Cxf vulnerabilities
- TI-2020-10930 Apache CXF Reflected XSS in the services listing page via the styleSheetPath CVSS 3.1MEDIUM 6.1
- TI-2010-01990 Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in… CVSS 3.1CRITICAL 9.8
- TI-2022-22907 Apache CXF SSRF Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-47481 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage CVSS 3.1CRITICAL 9.8
- TI-2025-31053 Apache CXF: Untrusted JMS configuration can lead to RCE CVSS 3.1CRITICAL 9.8
- TI-2026-47860 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-12419 · CVE Program
- CVE-2019-12419 · NVD
- FIRST EPSS
- GHSA-cw6w-q88j-6mqf · GitHub Advisory Database · CC BY 4.0
- CVE-2019-12419 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences