// For flags

CVE-2020-13954

Apache CXF Reflected XSS in the services listing page via the styleSheetPath

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.

Por defecto, Apache CXF crea una página /services que contiene una lista de los nombres y direcciones de los endpoints disponibles. Esta página web es vulnerable a un ataque de tipo Cross-Site Scripting (XSS) reflejado por medio de styleSheetPath, que permite a un actor malicioso inyectar javascript en la página web. Esta vulnerabilidad afecta a todas las versiones de Apache CXF versiones anteriores a 3.4.1 y 3.3.8. Por favor tome en cuenta que este es un problema independiente de CVE-2019-17573

*Credits: Thanks to Ryan Lambeth for reporting this issue.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-06-08 CVE Reserved
  • 2020-11-12 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-10-19 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (17)
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
Cxf
Search vendor "Apache" for product "Cxf"
< 3.3.8
Search vendor "Apache" for product "Cxf" and version " < 3.3.8"
-
Affected
Apache
Search vendor "Apache"
Cxf
Search vendor "Apache" for product "Cxf"
>= 3.4.0 < 3.4.1
Search vendor "Apache" for product "Cxf" and version " >= 3.4.0 < 3.4.1"
-
Affected
Netapp
Search vendor "Netapp"
Snap Creator Framework
Search vendor "Netapp" for product "Snap Creator Framework"
--
Affected
Netapp
Search vendor "Netapp"
Vasa Provider For Clustered Data Ontap
Search vendor "Netapp" for product "Vasa Provider For Clustered Data Ontap"
>= 9.6
Search vendor "Netapp" for product "Vasa Provider For Clustered Data Ontap" and version " >= 9.6"
-
Affected
Oracle
Search vendor "Oracle"
Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
5.5.0.0.0
Search vendor "Oracle" for product "Business Intelligence" and version "5.5.0.0.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
5.9.0.0.0
Search vendor "Oracle" for product "Business Intelligence" and version "5.9.0.0.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
12.2.1.3.0
Search vendor "Oracle" for product "Business Intelligence" and version "12.2.1.3.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
12.2.1.4.0
Search vendor "Oracle" for product "Business Intelligence" and version "12.2.1.4.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
Retail Order Broker Cloud Service
Search vendor "Oracle" for product "Retail Order Broker Cloud Service"
15.0
Search vendor "Oracle" for product "Retail Order Broker Cloud Service" and version "15.0"
-
Affected
Oracle
Search vendor "Oracle"
Communications Messaging Server
Search vendor "Oracle" for product "Communications Messaging Server"
8.0.2
Search vendor "Oracle" for product "Communications Messaging Server" and version "8.0.2"
-
Affected
Oracle
Search vendor "Oracle"
Communications Messaging Server
Search vendor "Oracle" for product "Communications Messaging Server"
8.1
Search vendor "Oracle" for product "Communications Messaging Server" and version "8.1"
-
Affected