Published: 02/04/2021 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions before 3.4.3; Apache CXF versions before 3.3.10.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache cxf
oracle business intelligence 12.2.1.3.0
oracle business intelligence 12.2.1.4.0
oracle business intelligence 5.5.0.0.0
oracle communications session route manager
oracle communications session report manager
oracle business intelligence 5.9.0.0.0
oracle communications element manager 8.2.2
oracle communications diameter intelligence hub

Synopsis Moderate: Red Hat JBoss Web Server 570 release and security update Type/Severity Security Advisory: Moderate Topic Red Hat JBoss Web Server 570 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Microsoft WindowsRed Hat Product Security has rated this release as having a security impact ...

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 20 Authorization Framework: JWT Secured Authorization Request (JAR)) Instead of sending a JWT token as a &quot;request&quot; parameter, the spec also supports specifying a URI from which to retrieve a JWT token ...

Multiple vulnerabilities have been found in Hitachi Ops Center Common Services CVE-2020-1695, CVE-2020-1723, CVE-2020-1725, CVE-2020-10770, CVE-2020-14302, CVE-2020-15522, CVE-2020-25711, CVE-2020-27838, CVE-2020-28052, CVE-2020-28491, CVE-2021-3424, CVE-2021-3712, CVE-2021-20195, CVE-2021-20202, CVE-2021-20222, CVE-2021-20262, CVE-2021-21290, C ...

oss-sec mailing list archives   By Date By Thread </form>    CVE-2021-22696: Apache CXF: OAuth 2 authorization service vulnerable to DDos attacks  <!--X-Head-of ...

CWE-918 https://cxf.apache.org/security-advisories.data/CVE-2021-22696.txt.asc http://www.openwall.com/lists/oss-security/2021/04/02/2 https://www.oracle.com/security-alerts/cpuoct2021.html https://www.oracle.com/security-alerts/cpuapr2022.html https://lists.apache.org/thread.html/r8651c06212c56294a1c0ea61a5ad7790c06502209c03f05c0c7c9914%40%3Cdev.cxf.apache.org%3E https://lists.apache.org/thread.html/r8651c06212c56294a1c0ea61a5ad7790c06502209c03f05c0c7c9914%40%3Cusers.cxf.apache.org%3E https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E https://lists.apache.org/thread.html/r6445001cc5f9a2bb1e6316993753306e054bdd1d702656b7cbe59045%40%3Cannounce.apache.org%3E https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E https://access.redhat.com/errata/RHSA-2022:7273 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2021-22696

CVE-2021-22696

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect