$ cve CVE-2019-12419 JSON

CVE-2019-12419

9.8

CRITICAL · CVSS 3.1 · EPSS 13.8% (pctl 96)

Patch early

EPSS 13.8% — above the 10% action threshold.

Description

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	13.84% — more likely to be exploited than 96% of all CVEs
Weakness	CWE-863
On CISA KEV	no
Public exploit	none known
Published	2019-11-06
Last modified	2026-06-17

Affected (5)

Vendor	Product
apache	cxf
oracle	commerce guided search
oracle	enterprise manager base platform
oracle	flexcube private banking
oracle	retail order broker

References

→ the Explorer · watch your stack · NVD