Описание
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.
Меры по смягчению последствий
Users can disable the service listing altogether by setting the "hide-service-list-page" servlet parameter to "true".
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | cxf | Out of support scope | ||
| Red Hat BPM Suite 6 | cxf-core | Out of support scope | ||
| Red Hat Decision Manager 7 | cxf-core | Affected | ||
| Red Hat Integration Camel K 1 | cxf-core | Will not fix | ||
| Red Hat Integration Camel Quarkus 1 | cxf-core | Will not fix | ||
| Red Hat JBoss BRMS 6 | cxf | Out of support scope | ||
| Red Hat JBoss Data Virtualization 6 | cxf-core | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 6 | cxf-core | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 7 | cxf | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | cxf | Out of support scope |
Показывать по
Дополнительная информация
Статус:
6.1 Medium
CVSS3
Связанные уязвимости
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.
Уязвимость каркаса для веб-сервисов Apache CXF, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю проводить межсайтовые сценарные атаки
6.1 Medium
CVSS3