GitHub Advisoryadvisory · Maven

GHSA-64x2-gq24-75pv Cross-site scripting in Apache CXF

MEDIUM Published 2021-04-22 Modified 2021-04-20 Official page ↗
Aliases
CVE-2020-13954
Ecosystem
Maven
Packages
org.apache.cxf:apache-cxf, org.apache.cxf:cxf
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-04-20

Affected packages

• Maven org.apache.cxf:apache-cxf: < 3.3.8 → fixed in 3.3.8 • Maven org.apache.cxf:apache-cxf: >= 3.4.0, < 3.4.1 → fixed in 3.4.1 • Maven org.apache.cxf:cxf: < 3.3.8 → fixed in 3.3.8 • Maven org.apache.cxf:cxf: >= 3.4.0, < 3.4.1 → fixed in 3.4.1

Description

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.

Related

Alias · CVE (1)

  • CVE-2020-13954 By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References