A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade stax-exUpgrade jackson-coreUpgrade python3-nssUpgrade xmlstreambufferUpgrade xsomUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade xerces-j2Upgrade xml-commons-apisUpgrade python-nss-docUpgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade glassfish-jaxb-txw2Upgrade resteasyUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade apache-commons-net | May 4, 2022 | Mar 18, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-toolsUpgrade pki-javadocUpgrade pki-kraUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-ca | Apr 23, 2021 | Mar 18, 2020 |
| Centos_linux | — | Upgrade javassist-javadocUpgrade xalan-j2Upgrade apache-commons-netUpgrade slf4jUpgrade pki-symkey-debuginfoUpgrade jackson-databindUpgrade jackson-annotationsUpgrade jackson-coreUpgrade tomcatjssUpgrade glassfish-fastinfosetUpgrade xml-commons-apisUpgrade pki-kraUpgrade relaxngDatatypeUpgrade pki-base-javaUpgrade python-nss-debugsourceUpgrade pki-caUpgrade resteasyUpgrade python3-pkiUpgrade pki-serverUpgrade jss-javadocUpgrade jackson-module-jaxb-annotationsUpgrade jss-debugsourceUpgrade jackson-jaxrs-json-providerUpgrade pki-javadocUpgrade pki-servlet-4.0-apiUpgrade xsomUpgrade python3-nss-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-langUpgrade pki-toolsUpgrade xmlstreambufferUpgrade jackson-jaxrs-providersUpgrade apache-commons-collectionsUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade jssUpgrade xerces-j2Upgrade pki-core-debuginfoUpgrade stax-exUpgrade python-nss-docUpgrade glassfish-jaxb-coreUpgrade ldapjdk-javadocUpgrade jss-debuginfoUpgrade velocityUpgrade bea-stax-apiUpgrade pki-servlet-engineUpgrade pki-symkeyUpgrade slf4j-jdk14Upgrade pki-tools-debuginfoUpgrade glassfish-jaxb-apiUpgrade xml-commons-resolverUpgrade ldapjdkUpgrade javassistUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade python3-nss | Nov 5, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-baseUpgrade pki-kraUpgrade pki-caUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-server | Feb 22, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-base-javaUpgrade pki-serverUpgrade pki-kraUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-caUpgrade pki-tools | Apr 30, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-caUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-toolsUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-base | Dec 16, 2020 | Mar 18, 2020 |
| Oracle_linux | — | Upgrade python3-pkiUpgrade xml-commons-apisUpgrade jss-javadocUpgrade slf4jUpgrade pki-toolsUpgrade tomcatjssUpgrade resteasyUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade pki-caUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade jackson-databindUpgrade apache-commons-netUpgrade jackson-jaxrs-providersUpgrade jackson-jaxrs-json-providerUpgrade pki-serverUpgrade pki-javadocUpgrade jackson-coreUpgrade pki-kraUpgrade pki-base-javaUpgrade apache-commons-langUpgrade pki-servlet-4.0-apiUpgrade pki-baseUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade pki-symkeyUpgrade bea-stax-apiUpgrade python-nss-docUpgrade ldapjdkUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade ldapjdk-javadocUpgrade javassistUpgrade python3-nssUpgrade jakarta-commons-httpclientUpgrade stax-exUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-apiUpgrade javassist-javadocUpgrade jssUpgrade xmlstreambufferUpgrade velocity | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade slf4j-jdk14Upgrade python3-pkiUpgrade jackson-jaxrs-json-providerUpgrade resteasyUpgrade glassfish-jaxb-runtimeUpgrade stax-exUpgrade jackson-coreUpgrade xsomUpgrade jackson-annotationsUpgrade pki-symkey-debuginfoUpgrade slf4jUpgrade jss-javadocUpgrade xmlstreambufferUpgrade ldapjdkUpgrade relaxngDatatypeUpgrade pki-javadocUpgrade velocityUpgrade jackson-databindUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade apache-commons-langUpgrade pki-caUpgrade tomcatjssUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade pki-serverUpgrade pki-toolsUpgrade python-nss-debugsourceUpgrade jss-debugsourceUpgrade pki-kraUpgrade python3-nss-debuginfoUpgrade xalan-j2Upgrade pki-core-debugsourceUpgrade python3-nssUpgrade ldapjdk-javadocUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade apache-commons-netUpgrade pki-symkeyUpgrade jss-debuginfoUpgrade pki-tools-debuginfoUpgrade pki-baseUpgrade glassfish-jaxb-apiUpgrade javassist-javadocUpgrade jssUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade apache-commons-collectionsUpgrade pki-servlet-engineUpgrade pki-base-javaUpgrade pki-core-debuginfoUpgrade bea-stax-apiUpgrade python-nss-docUpgrade xml-commons-resolverUpgrade glassfish-fastinfosetUpgrade pki-servlet-4.0-api | Nov 5, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub