GHSA-f8p7-h97q-7vx7
Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.cxf:cxf-rt-rs-security-oauth2 | >= 4.2.0, < 4.2.2 | 4.2.2 |
| Maven | org.apache.cxf:cxf-rt-rs-security-oauth2 | < 4.1.7 | 4.1.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
References
External links from the advisory. They lead to third-party sites.