GitHub Advisoryadvisory · Maven

GHSA-f93p-f762-vr53 Reflected Cross-Site Scripting in Apache CXF

MEDIUM Published 2020-06-10 Modified 2021-06-15 Official page ↗
Aliases
CVE-2019-17573
Ecosystem
Maven
Packages
org.apache.cxf:apache-cxf, org.apache.cxf:cxf
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-09

Affected packages

• Maven org.apache.cxf:apache-cxf: < 3.2.12 → fixed in 3.2.12 • Maven org.apache.cxf:apache-cxf: >= 3.3.0, < 3.3.5 → fixed in 3.3.5 • Maven org.apache.cxf:cxf: < 3.2.12 → fixed in 3.2.12 • Maven org.apache.cxf:cxf: >= 3.3.0, < 3.3.5 → fixed in 3.3.5

Description

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.

Related

Alias · CVE (1)

  • CVE-2019-17573 By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References