Vulnerability · Published Nov 12, 2020 · Assigned by apache
CVE-2020-13954Apache CXF Reflected XSS in the services listing page via the styleSheetPath
Medium 6.1
In plain English
A medium-severity cross-site scripting in Apache CXF from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 40.9% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.cxf:apache-cxf | 3.3.8 | GHSA-64x2-gq24-75pv |
| Maven | org.apache.cxf:apache-cxf | 3.4.1 | GHSA-64x2-gq24-75pv |
| Maven | org.apache.cxf:cxf | 3.3.8 | GHSA-64x2-gq24-75pv |
| Maven | org.apache.cxf:cxf | 3.4.1 | GHSA-64x2-gq24-75pv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache CXF | unspecified – before 3.4.1unspecified – before 3.3.8 |
Weakness: CWE-79
References
- http://cxf.apache.org/security-advisories.data/CVE-2020-13954.txt.asc?version=1&modificationDate=1605183670659&api=v2 x_refsource_MISC
- [cxf-dev] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath mailing-list, x_refsource_MLIST
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html mailing-list, x_refsource_MLIST
- [cxf-users] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath mailing-list, x_refsource_MLIST
- [oss-security] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath mailing-list, x_refsource_MLIST
- [announce] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath mailing-list, x_refsource_MLIST
- [cxf-users] 20201125 RE: CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html mailing-list, x_refsource_MLIST
- [syncope-dev] 20210526 [GitHub] [syncope] coheigea opened a new pull request #268: Disable CXF Services Listing mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210513-0010/ x_refsource_CONFIRM
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC