Описание
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.
Меры по смягчению последствий
Mitigate this flaw by disabling the service listing altogether; via setting the "hide-service-list-page" servlet parameter to "true".
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | cxf | Out of support scope | ||
| Red Hat BPM Suite 6 | cxf-core | Out of support scope | ||
| Red Hat JBoss BRMS 6 | cxf | Out of support scope | ||
| Red Hat JBoss Data Virtualization 6 | cxf-core | Out of support scope | ||
| Red Hat JBoss Fuse 6 | cxf-core | Out of support scope | ||
| Red Hat OpenShift Application Runtimes | cxf-core | Affected | ||
| Red Hat support for Spring Boot | cxf-core | Will not fix | ||
| EAP-CD 19 Tech Preview | cxf | Fixed | RHSA-2020:2333 | 28.05.2020 |
| Red Hat Decision Manager 7 | cxf-core | Fixed | RHSA-2020:3196 | 29.07.2020 |
| Red Hat Fuse 7.7.0 | cxf-core | Fixed | RHSA-2020:3192 | 28.07.2020 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.
Уязвимость каркаса для веб-сервисов Apache CXF, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю осуществить межсайтовую сценарную атаку
EPSS
6.1 Medium
CVSS3