Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

Affected: Maven: org.apache.cxf:cxf

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

thrift: Endless loop when feed with specific input data thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol keycloak: missing signatures validation on CRL used to verify client certificates HTTP/2: large amount of data requests leads to denial of service HTTP/2: flood using PING frames results in unbounded memory growth HTTP/2: flood using HEADERS frames results in unbounded memory growth HTTP/2: flood using SETTINGS frames results in unbounded memory growth apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default keycloak: CSRF check missing in My Resources functionality in the Account Console keycloak: SAML broker does not check existence of signature on document allowing any user impersonation hibernate-validator: safeHTML validator allows XSS xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source cxf: does not restrict the number of message attachments cxf: OpenId Connect token service does not properly validate the clientId jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig keycloak: adapter endpoints are exposed via arbitrary URLs keycloak: cross-realm user access auth bypass wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use undertow: possible Denial Of Service (DOS) in Undertow HTTP server listen…

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um einen Denial of Service Angriff durchzuführen oder um Sicherheitsvorkehrungen zu umgehen.