A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade xml-commons-apisUpgrade python-nss-docUpgrade pki-servlet-engineUpgrade python3-nssUpgrade stax-exUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade velocityUpgrade jackson-coreUpgrade bea-stax-apiUpgrade javassistUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade jackson-annotationsUpgrade xmlstreambufferUpgrade xalan-j2Upgrade jackson-databindUpgrade slf4jUpgrade apache-commons-netUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade apache-commons-langUpgrade xsomUpgrade resteasyUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtime | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-serverUpgrade pki-caUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-javadocUpgrade pki-baseUpgrade pki-base-javaUpgrade pki-toolsUpgrade pki-core-debuginfo | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade pki-javadocUpgrade pki-symkey-debuginfoUpgrade python3-nss-debuginfoUpgrade jssUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade pki-symkeyUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade python-nss-docUpgrade pki-kraUpgrade relaxngDatatypeUpgrade slf4jUpgrade slf4j-jdk14Upgrade glassfish-fastinfosetUpgrade pki-serverUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade jackson-annotationsUpgrade jss-debugsourceUpgrade pki-toolsUpgrade jss-debuginfoUpgrade apache-commons-collectionsUpgrade javassistUpgrade python-nss-debugsourceUpgrade ldapjdk-javadocUpgrade pki-servlet-engineUpgrade pki-tools-debuginfoUpgrade jackson-coreUpgrade ldapjdkUpgrade javassist-javadocUpgrade tomcatjssUpgrade resteasyUpgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade xmlstreambufferUpgrade python3-nssUpgrade pki-core-debugsourceUpgrade jackson-databindUpgrade apache-commons-netUpgrade python3-pkiUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade pki-base-javaUpgrade jackson-jaxrs-json-providerUpgrade pki-core-debuginfoUpgrade bea-stax-apiUpgrade pki-servlet-4.0-apiUpgrade xerces-j2Upgrade apache-commons-langUpgrade pki-baseUpgrade pki-caUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade jss-javadoc | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-symkeyUpgrade pki-toolsUpgrade pki-kraUpgrade pki-baseUpgrade pki-server | Sep 16, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-caUpgrade pki-toolsUpgrade pki-serverUpgrade pki-kraUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-base-java | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-kraUpgrade pki-baseUpgrade pki-caUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-server | Mar 24, 2021 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade pki-toolsUpgrade pki-servlet-4.0-apiUpgrade python3-nssUpgrade jackson-coreUpgrade python-nss-docUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade pki-symkeyUpgrade glassfish-jaxb-runtimeUpgrade stax-exUpgrade pki-caUpgrade jssUpgrade xml-commons-resolverUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-fastinfosetUpgrade pki-baseUpgrade pki-serverUpgrade slf4jUpgrade ldapjdkUpgrade apache-commons-langUpgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade ldapjdk-javadocUpgrade bea-stax-apiUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade xerces-j2Upgrade jss-javadocUpgrade xmlstreambufferUpgrade velocityUpgrade pki-javadocUpgrade javassist-javadocUpgrade tomcatjssUpgrade pki-kraUpgrade pki-servlet-engineUpgrade apache-commons-netUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-apiUpgrade python3-pkiUpgrade pki-base-javaUpgrade jackson-databindUpgrade xalan-j2Upgrade resteasy | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade python3-pkiUpgrade pki-servlet-4.0-apiUpgrade bea-stax-apiUpgrade pki-core-debuginfoUpgrade xerces-j2Upgrade pki-caUpgrade pki-baseUpgrade pki-symkeyUpgrade jackson-coreUpgrade apache-commons-langUpgrade resteasyUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade xsomUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade jackson-jaxrs-json-providerUpgrade apache-commons-collectionsNo solution existsUpgrade glassfish-jaxb-coreUpgrade pki-core-debugsourceUpgrade python3-nssUpgrade xmlstreambufferUpgrade pki-base-javaUpgrade glassfish-jaxb-txw2Upgrade jss-javadocUpgrade pki-tools-debuginfoUpgrade jackson-databindUpgrade javassist-javadocUpgrade tomcatjssUpgrade apache-commons-netUpgrade ldapjdkUpgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade ldapjdk-javadocUpgrade pki-serverUpgrade pki-servlet-engineUpgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade xml-commons-apisUpgrade pki-symkey-debuginfoUpgrade jakarta-commons-httpclientUpgrade jss-debugsourceUpgrade stax-exUpgrade jackson-annotationsUpgrade pki-javadocUpgrade glassfish-jaxb-apiUpgrade pki-toolsUpgrade jss-debuginfoUpgrade velocityUpgrade javassistUpgrade jssUpgrade slf4j-jdk14Upgrade pki-kraUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-providersUpgrade slf4j | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade python-nss-doc | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub