Lucene search

ApacheCVE-2020-13954

HistoryNov 12, 2020 - 1:15 p.m.

CVE-2020-13954

2020-11-1213:15:11

CWE-79

apache

web.nvd.nist.gov

104

cve-2020-13954

apache cxf

xss

reflected xss

security vulnerability

endpoint listing

apache cxf 3.4.1

apache cxf 3.3.8

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.8

Confidence

High

EPSS

0.205

Percentile

96.5%

JSON

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.

Affected configurations

Nvd

Vulners

Node

apachecxfRange<3.3.8

apachecxfRange3.4.0–3.4.1

Node

netappsnap_creator_frameworkMatch-

netappvasa_provider_for_clustered_data_ontapRange9.6≥

Node

oraclebusiness_intelligenceMatch5.5.0.0.0enterprise

oraclebusiness_intelligenceMatch5.9.0.0.0enterprise

oraclebusiness_intelligenceMatch12.2.1.3.0enterprise

oraclebusiness_intelligenceMatch12.2.1.4.0enterprise

oracleretail_order_broker_cloud_serviceMatch15.0

oraclecommunications_messaging_serverMatch8.0.2

oraclecommunications_messaging_serverMatch8.1

VendorProductVersionCPE
apachecxf*cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
netappsnap_creator_framework-cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
netappvasa_provider_for_clustered_data_ontap*cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*
oraclebusiness_intelligence5.5.0.0.0cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*
oraclebusiness_intelligence5.9.0.0.0cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*
oraclebusiness_intelligence12.2.1.3.0cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*
oraclebusiness_intelligence12.2.1.4.0cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*
oracleretail_order_broker_cloud_service15.0cpe:2.3:a:oracle:retail_order_broker_cloud_service:15.0:*:*:*:*:*:*:*
oraclecommunications_messaging_server8.0.2cpe:2.3:o:oracle:communications_messaging_server:8.0.2:*:*:*:*:*:*:*
oraclecommunications_messaging_server8.1cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	cxf	*	cpe:2.3:a:apache:cxf::::::::
netapp	snap_creator_framework	-	cpe:2.3:a:netapp:snap_creator_framework:-:::::::*
netapp	vasa_provider_for_clustered_data_ontap	*	cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap::::::::
oracle	business_intelligence	5.5.0.0.0	cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0::::enterprise:::
oracle	business_intelligence	5.9.0.0.0	cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0::::enterprise:::
oracle	business_intelligence	12.2.1.3.0	cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0::::enterprise:::
oracle	business_intelligence	12.2.1.4.0	cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0::::enterprise:::
oracle	retail_order_broker_cloud_service	15.0	cpe:2.3:a:oracle:retail_order_broker_cloud_service:15.0:::::::*
oracle	communications_messaging_server	8.0.2	cpe:2.3:o:oracle:communications_messaging_server:8.0.2:::::::*
oracle	communications_messaging_server	8.1	cpe:2.3:o:oracle:communications_messaging_server:8.1:::::::*

CNA Affected

[
  {
    "product": "Apache CXF",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.4.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "3.3.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

cxf.apache.org/security-advisories.data/CVE-2020-13954.txt.asc?version=1&modificationDate=1605183670659&api=v2

www.openwall.com/lists/oss-security/2020/11/12/2

lists.apache.org/thread.html/r51fdd73548290b2dfd0b48f7ab69bf9ae064dd100364cd8a15f0b3ec%40%3Cannounce.apache.org%3E

lists.apache.org/thread.html/r51fdd73548290b2dfd0b48f7ab69bf9ae064dd100364cd8a15f0b3ec%40%3Cdev.cxf.apache.org%3E

lists.apache.org/thread.html/r51fdd73548290b2dfd0b48f7ab69bf9ae064dd100364cd8a15f0b3ec%40%3Cusers.cxf.apache.org%3E

lists.apache.org/thread.html/r640719c9ce5671f239a6f002c20e14062effe4b318a580b6746aa5ef%40%3Cdev.syncope.apache.org%3E

lists.apache.org/thread.html/r81a41a2915985d49bc3ea57dde2018b03584a863878a8532a89f993f%40%3Cusers.cxf.apache.org%3E

lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E

lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E

lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E

security.netapp.com/advisory/ntap-20210513-0010/

www.oracle.com/security-alerts/cpuApr2021.html

www.oracle.com/security-alerts/cpuapr2022.html

www.oracle.com/security-alerts/cpujan2021.html

www.oracle.com/security-alerts/cpuoct2021.html

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.8

Confidence

High

EPSS

0.205

Percentile

96.5%

JSON

Related for CVE-2020-13954