The vulnerability of Apache CXF web services lies in the lack of measures taken to protect the structure of web pages, allowing attackers to perform cross-site scripting attacks.

The vulnerability of Apache CXF web services is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using the styleSheetPath parameter...

Cross-Site Scripting (XSS)

cxf-rt-transports-http is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the stykeSheetPath parameter...

CVE-2020-13954 Apache CXF Reflected XSS in the services listing page via the styleSheetPath

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This...