| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.cxf:apache-cxf | ≥ 3.4.0, < 3.4.1< 3.3.8 | 3.4.13.3.8 |
| org.apache.cxf:cxf | ≥ 3.4.0, < 3.4.1< 3.3.8 | 3.4.13.3.8 |
| cxf | ≥ 3.4.0, < 3.4.1< 3.3.8 | 3.4.13.3.8 |
| vasa provider for clustered data ontap | ≥ 9.6 | |
| business intelligence | = 12.2.1.3.0= 12.2.1.4.0= 5.5.0.0.0= 5.9.0.0.0 | |
| retail order broker cloud service | = 15.0 |
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free