Reflected XSS Vulnerability in Apache CXF Services Page
CVE-2019-17573

6.1MEDIUM

Key Information:

Vendor

Apache
Status
Cxf
Vendor
CVE Published:
16 January 2020

What is CVE-2019-17573?

Apache CXF, by default, generates a '/services' page that lists available endpoint names and addresses. This page is susceptible to reflected Cross-Site Scripting (XSS) attacks, enabling malicious actors to inject JavaScript code. Although this issue typically exploits a feature not found in contemporary browsers, mobile applications that access this page could be compromised. It is crucial for users and developers to apply security updates and implement measures to mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

CXF All versions of Apache CXF prior to 3.3.5 and 3.2.12.

References

https://lists.apache.org/thread.html/rf3b50583fefce2810cb...
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r36e44ffc1a9b365327d...
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af...
mailing-listx_refsource_MLIST

EPSS Score

16% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.