Lucene search

[email protected]CVE-2019-17573

HistoryJan 16, 2020 - 6:15 p.m.

CVE-2019-17573

2020-01-1618:15:00

CWE-79

[email protected]

web.nvd.nist.gov

146

cve-2019-17573

apache cxf

xss

reflected xss

web security

nvd

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.7 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.006 Low

EPSS

Percentile

77.8%

JSON

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.

CPENameOperatorVersion
apache:cxfapache cxfle3.2.12
apache:cxfapache cxflt3.3.5
oracle:flexcube_private_bankingoracle flexcube private bankingeq12.1.0
oracle:flexcube_private_bankingoracle flexcube private bankingeq12.0.0
oracle:retail_order_brokeroracle retail order brokereq15.0
oracle:communications_element_manageroracle communications element managereq8.2.0
oracle:communications_element_manageroracle communications element managereq8.2.1
oracle:communications_element_manageroracle communications element managereq8.1.1
oracle:communications_session_report_manageroracle communications session report managereq8.1.1
oracle:communications_session_report_manageroracle communications session report managereq8.2.0

CPE	Name	Operator	Version
apache:cxf	apache cxf	le	3.2.12
apache:cxf	apache cxf	lt	3.3.5
oracle:flexcube_private_banking	oracle flexcube private banking	eq	12.1.0
oracle:flexcube_private_banking	oracle flexcube private banking	eq	12.0.0
oracle:retail_order_broker	oracle retail order broker	eq	15.0
oracle:communications_element_manager	oracle communications element manager	eq	8.2.0
oracle:communications_element_manager	oracle communications element manager	eq	8.2.1
oracle:communications_element_manager	oracle communications element manager	eq	8.1.1
oracle:communications_session_report_manager	oracle communications session report manager	eq	8.1.1
oracle:communications_session_report_manager	oracle communications session report manager	eq	8.2.0