Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2019-17573

Published: 16/01/2020 Updated: 07/11/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8
VMScore: 384
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Subscribe to Apache

Vulnerability Summary

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache cxf

oracle flexcube private banking 12.1.0

oracle flexcube private banking 12.0.0

oracle retail order broker 15.0

oracle communications element manager 8.2.0

oracle communications element manager 8.2.1

oracle communications element manager 8.1.1

oracle communications session report manager 8.1.1

oracle communications session report manager 8.2.0

oracle communications session report manager 8.2.1

oracle communications session route manager 8.1.1

oracle communications session route manager 8.2.0

oracle communications session route manager 8.2.1

oracle commerce guided search 11.3.2

Vendor Advisories

Red Hat: Important: Red Hat build of Thorntail 2.7.0 security and bug fix update
Synopsis Important: Red Hat build of Thorntail 270 security and bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat build of ThorntailRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...
Red Hat: Moderate: Open Liberty 20.0.0.3 Runtime security update
Synopsis Moderate: Open Liberty 20003 Runtime security update Type/Severity Security Advisory: Moderate Topic Open Liberty 20003 Runtime is now available from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Syst ...
Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 security update
Synopsis Important: Red Hat JBoss Enterprise Application Platform 728 on RHEL 7 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 72 for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as ...
Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
Synopsis Important: Red Hat JBoss Enterprise Application Platform 731 Security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 73Red Hat Product Security has rated this update as having a security impact of Important A ...
Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
Synopsis Important: Red Hat JBoss Enterprise Application Platform 731 Security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 73 for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a ...
Red Hat: Important: Red Hat Process Automation Manager 7.8.0 Security Update
Synopsis Important: Red Hat Process Automation Manager 780 Security Update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Process Automation ManagerRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scori ...
Red Hat: Important: Red Hat Decision Manager 7.8.0 Security Update
Synopsis Important: Red Hat Decision Manager 780 Security Update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Decision ManagerRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) bas ...
Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
Synopsis Important: Red Hat JBoss Enterprise Application Platform 731 Security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 73 for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a ...
Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
Synopsis Important: Red Hat JBoss Enterprise Application Platform 731 Security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 73 for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a ...
Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update
Synopsis Important: Red Hat JBoss Enterprise Application Platform 728 on RHEL 6 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 72 for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as ...
Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.2.8 security update
Synopsis Important: Red Hat JBoss Enterprise Application Platform 728 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 72Red Hat Product Security has rated this update as having a security impact of Important A ...
Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update
Synopsis Important: Red Hat JBoss Enterprise Application Platform 728 on RHEL 8 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 72 for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as ...
Red Hat: Important: EAP Continuous Delivery Technical Preview Release 19 security update
Synopsis Important: EAP Continuous Delivery Technical Preview Release 19 security update Type/Severity Security Advisory: Important Topic This is a security update for JBoss EAP Continuous Delivery 19Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabi ...
Red Hat: Important: Red Hat Single Sign-On 7.3.8 security update
Synopsis Important: Red Hat Single Sign-On 738 security update Type/Severity Security Advisory: Important Topic A security update is now available for Red Hat Single Sign-On 73 from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...
Red Hat: Important: Red Hat Fuse 7.7.0 release and security update
Synopsis Important: Red Hat Fuse 770 release and security update Type/Severity Security Advisory: Important Topic A minor version update (from 76 to 77) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Produc ...

Mailing Lists

Full Disclosure: [CVE-2019-17573] Apache CXF Reflected XSS in the services listing page
<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> [CVE-2019-17573] Apache CXF Reflected XSS in the services listing page <!--X-Subject-Header-End--> <!--X-Head-of-Message--> ...
Full Disclosure: CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath
<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath <!--X-Subject-Header-End--> <!--X ...

References

CWE-79http://cxf.apache.org/security-advisories.data/CVE-2019-17573.txt.asc?version=1&modificationDate=1579178542000&api=v2https://www.oracle.com/security-alerts/cpujul2020.htmlhttp://www.openwall.com/lists/oss-security/2020/11/12/2https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://lists.apache.org/thread.html/rf3b50583fefce2810cbd37c3d358cbcd9a03e750005950bf54546194%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/r51fdd73548290b2dfd0b48f7ab69bf9ae064dd100364cd8a15f0b3ec%40%3Cdev.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/r51fdd73548290b2dfd0b48f7ab69bf9ae064dd100364cd8a15f0b3ec%40%3Cusers.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/r51fdd73548290b2dfd0b48f7ab69bf9ae064dd100364cd8a15f0b3ec%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r81a41a2915985d49bc3ea57dde2018b03584a863878a8532a89f993f%40%3Cusers.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3Ehttps://nvd.nist.govhttps://access.redhat.com/errata/RHSA-2020:2905
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27977IMAPlocal usersCVE-2024-32038CVE-2023-49963CVE-2023-22869CVE-2024-31497localCVE-2024-2961
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook