Описание
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
A flaw was found in cxf in versions prior to 3.2.11 and 3.3.4. The access token services do not properly validate that an authenticated principal is equal to that of the supplied clientId parameter allowing a malicious client to use an authorization code that has been issued to a different client as their own. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Отчет
In OpenShift Logging the openshift-logging/elasticsearch6-rhel8 container bundles the vulnerable version of apache-cxf, but the vulnerable class is not shipped, hence this component is not affected by this vulnerability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Logging Subsystem for Red Hat OpenShift | openshift-logging/elasticsearch6-rhel8 | Not affected | ||
| Red Hat BPM Suite 6 | cxf | Out of support scope | ||
| Red Hat BPM Suite 6 | cxf-core | Out of support scope | ||
| Red Hat Decision Manager 7 | cxf-core | Not affected | ||
| Red Hat Fuse 7 | cxf-core | Affected | ||
| Red Hat JBoss BRMS 6 | cxf | Out of support scope | ||
| Red Hat JBoss BRMS 6 | cxf-core | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 7 | cxf-core | Not affected | ||
| Red Hat JBoss Fuse 6 | cxf-core | Out of support scope | ||
| Red Hat OpenShift Application Runtimes | cxf-core | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
Уязвимость службы OpenId Connect каркаса для веб-сервисов Apache CXF, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
8.1 High
CVSS3