~ / search / GHSA-f93p-f762-vr53

GHSA-f93p-f762-vr53

Reflected Cross-Site Scripting in Apache CXF

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-17573

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.cxf:apache-cxf < 3.2.12 3.2.12
Maven org.apache.cxf:apache-cxf >= 3.3.0, < 3.3.5 3.3.5
Maven org.apache.cxf:cxf < 3.2.12 3.2.12
Maven org.apache.cxf:cxf >= 3.3.0, < 3.3.5 3.3.5

Details

As written in the advisory (Markdown source, shown as plain text).

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.

References

External links from the advisory. They lead to third-party sites.