CVE-2019-12423 Apache CXF
| Affected software | Apache CXF |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Fixed in | 3.2.12, 3.3.5 |
| Weakness | CWE-522 |
| Published | 16 Jan 2020 |
| Updated | 17 Jun 2026 |
Description
Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". For this case all keys are returned in this file "as is", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. "oct" keys, which contain secret keys, are not returned at all.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 6 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 6.1% chance in 30 days
Waratek protection
Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.
A public code fix exists.
- Protection none
- Action unverified
- Review automated Upstream data
- Record active
| Decided by | Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all |
|---|---|
| Finding | This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious. |
| Candidate fix | https://access.redhat.com/security/cve/CVE-2019-12423 : a Red Hat CVE page: the weakest kind, naming no commit, though it shows Red Hat has looked at the CVE |
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2021 ↗ | CPU | 2021-Q2 | Oracle Commerce / Content Acquisition System (Apache CXF) (11.3.2) |
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle Communications Applications / REST API (Apache CXF) (8.1.1, 8.2.0, 8.2.1) Oracle Communications Applications / REST API (Apache CXF) (8.1.1, 8.2.0, 8.2.1) Oracle Communications Applications / REST API (Apache CXF) (8.1.1, 8.2.0, 8.2.1) Oracle Financial Services Applications / Core (Apache CXF) (12.0.0, 12.1.0) Oracle Retail Applications / System Administration (Apache CXF) (15.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Commerce | Content Acquisition System (Apache CXF) | 11.3.2 | 11.3.2 |
| Oracle Communications Applications | REST API (Apache CXF) | 8.1.1, 8.2.0, 8.2.1 | 8.1.1 · 8.2.0 · 8.2.1 |
| Oracle Financial Services Applications | Core (Apache CXF) | 12.0.0, 12.1.0 | 12.0.0 · 12.1.0 |
| Oracle Retail Applications | System Administration (Apache CXF) | 15.0 | 15.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.cxf:apache-cxf |
0 | 3.2.12 |
unbounded |
org.apache.cxf:apache-cxf |
3.3.0 | 3.3.5 |
unbounded |
org.apache.cxf:cxf |
0 | 3.2.12 |
unbounded |
org.apache.cxf:cxf |
3.3.0 | 3.3.5 |
unbounded |
Products and versions
10 products, 16 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | cxf | generic | ＜ 3.2.12 · ≥ 3.3.0 and ＜ 3.3.5 |
| nvd | oracle | commerce guided search | generic | 11.3.2 |
| nvd | oracle | communications diameter signaling router | generic | ≥ 8.0.0 and ≤ 8.2.2 |
| nvd | oracle | communications element manager | generic | ≥ 8.2.0 and ≤ 8.2.2 |
| nvd | oracle | communications session report manager | generic | ≥ 8.2.0 and ≤ 8.2.2 |
| nvd | oracle | communications session route manager | generic | 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | flexcube private banking | generic | 12.0.0 · 12.1.0 |
| nvd | oracle | retail order broker | generic | 15.0 |
| osv | org.apache.cxf | apache-cxf | generic | ＜ 3.2.12 · ≥ 3.3.0 and ＜ 3.3.5 |
| osv | org.apache.cxf | cxf | generic | ＜ 3.2.12 · ≥ 3.3.0 and ＜ 3.3.5 |
References
Timeline
Timeline
| Published | 2020-01-16 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |