Reflected XSS Vulnerability in Apache CXF Services Page

CVE-2019-17573

Summary

Apache CXF, by default, generates a '/services' page that lists available endpoint names and addresses. This page is susceptible to reflected Cross-Site Scripting (XSS) attacks, enabling malicious actors to inject JavaScript code. Although this issue typically exploits a feature not found in contemporary browsers, mobile applications that access this page could be compromised. It is crucial for users and developers to apply security updates and implement measures to mitigate these risks.

References