CVE-2019-12423

apache cxf, oracle commerce guided search, oracle communications diameter signaling router +5 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2019-12423

Katalog CVE

CVSS 7.5 · High EPSS 6,1%

Kerentanan Insufficiently Protected Credentials pada apache cxf, oracle commerce guided search +6 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". For this case all keys are returned in this file "as is", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. "oct" keys, which contain secret keys, are not returned at all.

Rincian

Terbit di NVD
16 Januari 2020
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-522: Insufficiently Protected Credentials
EPSS (30 hari)
6,1% peluang dieksploitasi; lebih tinggi dari 93,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
apache cxf Semua versi sebelum 3.2.12
apache cxf Versi 3.3.0 hingga sebelum 3.3.5
oracle commerce guided search Versi 11.3.2
oracle communications diameter signaling router Versi 8.0.0 hingga 8.2.2
oracle communications element manager Versi 8.2.0 hingga 8.2.2
oracle communications session report manager Versi 8.2.0 hingga 8.2.2
oracle communications session route manager Versi 8.1.1
oracle communications session route manager Versi 8.2.0
oracle communications session route manager Versi 8.2.1
oracle flexcube private banking Versi 12.0.0
oracle flexcube private banking Versi 12.1.0
oracle retail order broker Versi 15.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.