A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xalan-j2Upgrade resteasyUpgrade jackson-jaxrs-json-providerUpgrade slf4jUpgrade pki-servlet-4.0-apiUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade xsomUpgrade pki-servlet-engineUpgrade apache-commons-netUpgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade bea-stax-apiUpgrade glassfish-jaxb-coreUpgrade xmlstreambufferUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade xerces-j2Upgrade python3-nssUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade stax-exUpgrade python-nss-docUpgrade jackson-databindUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade velocityUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade javassist-javadoc | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-symkeyUpgrade pki-serverUpgrade pki-caUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade pki-base-javaUpgrade pki-javadocUpgrade pki-kra | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade tomcatjssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade jackson-annotationsUpgrade xmlstreambufferUpgrade python3-pkiUpgrade xalan-j2Upgrade slf4jUpgrade glassfish-jaxb-coreUpgrade apache-commons-netUpgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-runtimeUpgrade pki-baseUpgrade xml-commons-resolverUpgrade pki-caUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade glassfish-fastinfosetUpgrade pki-toolsUpgrade pki-base-javaUpgrade apache-commons-langUpgrade jss-debugsourceUpgrade pki-core-debuginfoUpgrade pki-serverUpgrade pki-core-debugsourceUpgrade xsomUpgrade pki-servlet-4.0-apiUpgrade ldapjdk-javadocUpgrade jss-javadocUpgrade relaxngDatatypeUpgrade pki-servlet-engineUpgrade pki-symkey-debuginfoUpgrade jackson-coreUpgrade apache-commons-collectionsUpgrade jssUpgrade python3-nssUpgrade python-nss-docUpgrade velocityUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-apiUpgrade ldapjdkUpgrade xerces-j2Upgrade jss-debuginfoUpgrade stax-exUpgrade slf4j-jdk14Upgrade xml-commons-apisUpgrade pki-symkeyUpgrade pki-javadocUpgrade pki-tools-debuginfoUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade pki-kra | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-ca | Feb 22, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-caUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-toolsUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-base | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-serverUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-baseUpgrade pki-caUpgrade pki-symkeyUpgrade pki-tools | Dec 16, 2020 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade velocityUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-coreUpgrade jackson-coreUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade pki-servlet-engineUpgrade pki-symkeyUpgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade ldapjdkUpgrade jackson-databindUpgrade python3-pkiUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade apache-commons-collectionsUpgrade stax-exUpgrade xerces-j2Upgrade python3-nssUpgrade slf4j-jdk14Upgrade pki-baseUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade pki-javadocUpgrade jss-javadocUpgrade slf4jUpgrade xml-commons-apisUpgrade javassistUpgrade pki-base-javaUpgrade pki-toolsUpgrade apache-commons-netUpgrade apache-commons-langUpgrade pki-kraUpgrade relaxngDatatypeUpgrade pki-servlet-4.0-apiUpgrade xsomUpgrade glassfish-fastinfosetUpgrade javassist-javadocUpgrade ldapjdk-javadocUpgrade resteasyUpgrade pki-serverUpgrade jssUpgrade pki-caUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclientUpgrade tomcatjss | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade pki-symkey-debuginfoUpgrade pki-base-javaUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-providersUpgrade tomcatjssUpgrade python3-pkiUpgrade jss-javadocUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-apiUpgrade resteasyUpgrade velocityUpgrade ldapjdkUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade stax-exUpgrade pki-javadocUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade pki-servlet-engineUpgrade pki-tools-debuginfoUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade jss-debugsourceUpgrade pki-core-debugsourceUpgrade python3-nss-debuginfoUpgrade pki-core-debuginfoUpgrade pki-toolsUpgrade python-nss-debugsourceUpgrade jss-debuginfoUpgrade python3-nssUpgrade slf4jUpgrade relaxngDatatypeUpgrade xml-commons-apisUpgrade xml-commons-resolverUpgrade pki-serverUpgrade xsomUpgrade xalan-j2Upgrade pki-caUpgrade jackson-annotationsUpgrade xmlstreambufferUpgrade pki-symkeyUpgrade pki-baseUpgrade apache-commons-netUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade jssUpgrade pki-kraUpgrade python-nss-docUpgrade jackson-coreUpgrade xerces-j2 | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub