| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| org.apache.cxf:apache-cxf | ≥ 3.3.0, < 3.3.5< 3.2.12 | 3.3.53.2.12 |
| org.apache.cxf:cxf | ≥ 3.3.0, < 3.3.5< 3.2.12 | 3.3.53.2.12 |
| cxf | ≥ 3.2.0, ≤ 3.2.12≥ 3.3.0, < 3.3.5 | 3.3.5 |
| commerce guided search | = 11.3.2 | |
| communications element manager | = 8.1.1= 8.2.0= 8.2.1 | |
| communications session report manager | = 8.1.1= 8.2.0= 8.2.1 | |
| communications session route manager | = 8.1.1= 8.2.0= 8.2.1 | |
| flexcube private banking | = 12.0.0= 12.1.0 | |
| retail order broker | = 15.0 |
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン