A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade apache-commons-netUpgrade glassfish-fastinfosetUpgrade jackson-coreUpgrade pki-servlet-4.0-apiUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade resteasyUpgrade xsomUpgrade jackson-jaxrs-json-providerUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade xalan-j2Upgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade python3-nssUpgrade stax-exUpgrade xml-commons-resolverUpgrade bea-stax-apiUpgrade xerces-j2Upgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade velocityUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade javassist | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-baseUpgrade pki-symkeyUpgrade pki-caUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade pki-serverUpgrade pki-kraUpgrade pki-javadocUpgrade pki-base-java | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade jackson-databindUpgrade stax-exUpgrade pki-javadocUpgrade xml-commons-apisUpgrade jssUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade jss-debuginfoUpgrade pki-servlet-engineUpgrade pki-kraUpgrade ldapjdkUpgrade jackson-jaxrs-providersUpgrade velocityUpgrade bea-stax-apiUpgrade python3-nssUpgrade slf4j-jdk14Upgrade pki-tools-debuginfoUpgrade pki-symkeyUpgrade pki-symkey-debuginfoUpgrade xerces-j2Upgrade apache-commons-collectionsUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade xsomUpgrade pki-toolsUpgrade apache-commons-netUpgrade pki-caUpgrade pki-base-javaUpgrade pki-serverUpgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade javassistUpgrade apache-commons-langUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-txw2Upgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclientUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade resteasyUpgrade slf4jUpgrade xmlstreambufferUpgrade python3-pkiUpgrade xalan-j2Upgrade pki-baseUpgrade tomcatjssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-coreUpgrade pki-core-debugsourceUpgrade pki-core-debuginfoUpgrade jss-debugsourceUpgrade jss-javadoc | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-serverUpgrade pki-caUpgrade pki-toolsUpgrade pki-baseUpgrade pki-kraUpgrade pki-symkey | Feb 22, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-base-javaUpgrade pki-serverUpgrade pki-toolsUpgrade pki-caUpgrade pki-kraUpgrade pki-baseUpgrade pki-symkey | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-base-javaUpgrade pki-serverUpgrade pki-baseUpgrade pki-kraUpgrade pki-toolsUpgrade pki-caUpgrade pki-symkey | Dec 16, 2020 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade python3-nssUpgrade bea-stax-apiUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade pki-symkeyUpgrade pki-baseUpgrade velocityUpgrade python3-pkiUpgrade jackson-coreUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade xml-commons-resolverUpgrade jackson-jaxrs-providersUpgrade ldapjdkUpgrade glassfish-jaxb-runtimeUpgrade python-nss-docUpgrade stax-exUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade xmlstreambufferUpgrade pki-servlet-engineUpgrade pki-caUpgrade resteasyUpgrade pki-serverUpgrade pki-toolsUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade javassistUpgrade xsomUpgrade ldapjdk-javadocUpgrade slf4jUpgrade xml-commons-apisUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade jss-javadocUpgrade apache-commons-netUpgrade pki-javadocUpgrade jssUpgrade tomcatjssUpgrade pki-base-javaUpgrade relaxngDatatypeUpgrade pki-kraUpgrade jakarta-commons-httpclientUpgrade apache-commons-langUpgrade javassist-javadocUpgrade pki-servlet-4.0-api | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade pki-caUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade pki-serverUpgrade jss-debuginfoUpgrade pki-toolsUpgrade python3-nssUpgrade jackson-databindUpgrade pki-servlet-4.0-apiUpgrade jssUpgrade slf4jUpgrade pki-baseUpgrade pki-symkeyUpgrade python-nss-docUpgrade xsomUpgrade xalan-j2Upgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade xmlstreambufferUpgrade relaxngDatatypeUpgrade pki-kraUpgrade jackson-jaxrs-json-providerUpgrade python-nss-debugsourceUpgrade xerces-j2Upgrade javassist-javadocUpgrade apache-commons-netUpgrade jss-debugsourceUpgrade jackson-annotationsUpgrade jackson-coreUpgrade pki-core-debuginfoUpgrade pki-core-debugsourceUpgrade python3-nss-debuginfoUpgrade python3-pkiUpgrade stax-exUpgrade tomcatjssUpgrade pki-javadocUpgrade velocityUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade apache-commons-collectionsUpgrade bea-stax-apiUpgrade pki-base-javaUpgrade glassfish-fastinfosetUpgrade pki-symkey-debuginfoUpgrade javassistUpgrade slf4j-jdk14Upgrade resteasyUpgrade pki-servlet-engineUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade ldapjdkUpgrade ldapjdk-javadocUpgrade jss-javadocUpgrade pki-tools-debuginfoUpgrade jackson-jaxrs-providers | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nssUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub