| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| org.apache.cxf:cxf | ≥ 3.3.0, < 3.3.4< 3.2.11 | 3.3.43.2.11 |
| cxf | ≥ 3.2.0, < 3.2.11≥ 3.3.0, < 3.3.4 | 3.2.113.3.4 |
| commerce guided search | = 11.3.2 | |
| enterprise manager base platform | = 13.2.1.0 | |
| flexcube private banking | = 12.0.0= 12.1.0 | |
| retail order broker | = 15.0 |
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン