Vulnerability · Published Oct 16, 2023 · Assigned by apache

CVE-2023-45757Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability

Medium 6.1

In plain English

A medium-severity cross-site scripting in Apache bRPC from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)1.2%top 30.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page. Solution (choose one of three): 1. upgrade to bRPC > 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2411 3. disable rpcz feature

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache bRPC	0.9.0 – through 1.6.0

Weakness: CWE-79

In plain English

Official description

Affected products (as reported)

References