CVE-2020-13954CWE-79

Apache CXF Reflected XSS in the services listing page via the styleSheetPath

published November 12, 2020

CVSS
—
EPSS
41%
Percentile
98.7
In the wild
Unconfirmed
What it is

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.40873 · 98.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-11-12T12:45Z
EPSS history
Timeline
  • 12 NOV 12:45Z
    Apache CXF Reflected XSS in the services listing page via the styleSheetPath
    cvelistv5