A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xml-commons-apisUpgrade python3-nssUpgrade jackson-coreUpgrade stax-exUpgrade pki-servlet-engineUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade python-nss-docUpgrade glassfish-jaxb-apiUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade resteasyUpgrade javassistUpgrade jackson-annotationsUpgrade glassfish-jaxb-runtimeUpgrade xalan-j2Upgrade javassist-javadocUpgrade pki-servlet-4.0-apiUpgrade apache-commons-netUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade xerces-j2Upgrade xmlstreambufferUpgrade slf4jUpgrade xsomUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2 | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-caUpgrade pki-serverUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade pki-javadocUpgrade pki-toolsUpgrade pki-base-java | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade python-nss-docUpgrade pki-serverUpgrade jss-debuginfoUpgrade pki-kraUpgrade slf4j-jdk14Upgrade python-nss-debugsourceUpgrade jackson-annotationsUpgrade pki-servlet-engineUpgrade xsomUpgrade javassistUpgrade pki-javadocUpgrade slf4jUpgrade python3-nss-debuginfoUpgrade velocityUpgrade pki-toolsUpgrade glassfish-fastinfosetUpgrade pki-symkey-debuginfoUpgrade relaxngDatatypeUpgrade apache-commons-collectionsUpgrade jackson-jaxrs-providersUpgrade ldapjdk-javadocUpgrade jssUpgrade jss-debugsourceUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade pki-symkeyUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade python3-nssUpgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade xmlstreambufferUpgrade pki-caUpgrade jackson-databindUpgrade pki-core-debugsourceUpgrade pki-base-javaUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-coreUpgrade resteasyUpgrade pki-servlet-4.0-apiUpgrade pki-tools-debuginfoUpgrade xalan-j2Upgrade python3-pkiUpgrade bea-stax-apiUpgrade tomcatjssUpgrade ldapjdkUpgrade jss-javadocUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade pki-core-debuginfoUpgrade apache-commons-langUpgrade jackson-coreUpgrade pki-baseUpgrade xerces-j2Upgrade apache-commons-net | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-baseUpgrade pki-kraUpgrade pki-serverUpgrade pki-caUpgrade pki-symkeyUpgrade pki-tools | Sep 16, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-serverUpgrade pki-caUpgrade pki-kraUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-symkey | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-kraUpgrade pki-caUpgrade pki-baseUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-tools | Mar 24, 2021 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade python3-nssUpgrade pki-symkeyUpgrade pki-toolsUpgrade jssUpgrade jackson-jaxrs-providersUpgrade pki-caUpgrade stax-exUpgrade slf4j-jdk14Upgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade xsomUpgrade python-nss-docUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade pki-serverUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade xalan-j2Upgrade javassistUpgrade resteasyUpgrade xmlstreambufferUpgrade glassfish-fastinfosetUpgrade pki-servlet-engineUpgrade pki-kraUpgrade python3-pkiUpgrade slf4jUpgrade xml-commons-apisUpgrade ldapjdkUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade jackson-annotationsUpgrade glassfish-jaxb-coreUpgrade tomcatjssUpgrade javassist-javadocUpgrade apache-commons-netUpgrade pki-javadocUpgrade bea-stax-apiUpgrade jackson-jaxrs-json-providerUpgrade velocityUpgrade pki-base-javaUpgrade relaxngDatatypeUpgrade jackson-databindUpgrade pki-baseUpgrade jss-javadocUpgrade ldapjdk-javadoc | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade pki-toolsUpgrade xml-commons-apisUpgrade jssUpgrade jackson-annotationsUpgrade jss-debugsourceUpgrade pki-symkey-debuginfoUpgrade jakarta-commons-httpclientUpgrade ldapjdk-javadocUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade jackson-module-jaxb-annotationsUpgrade pki-javadocUpgrade relaxngDatatypeUpgrade pki-servlet-engineUpgrade stax-exUpgrade pki-serverUpgrade jackson-jaxrs-providersUpgrade pki-kraUpgrade python-nss-debugsourceUpgrade slf4jUpgrade slf4j-jdk14Upgrade javassistUpgrade jss-debuginfoUpgrade xsomUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade python3-nssUpgrade pki-servlet-4.0-apiUpgrade ldapjdkUpgrade python3-pkiUpgrade pki-caUpgrade jss-javadocUpgrade glassfish-jaxb-txw2Upgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade xerces-j2Upgrade pki-baseUpgrade bea-stax-apiUpgrade javassist-javadocUpgrade tomcatjssUpgrade pki-base-javaUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-json-providerUpgrade python3-nss-debuginfoUpgrade resteasyUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade xmlstreambufferUpgrade python-nss-docUpgrade apache-commons-langUpgrade jackson-coreUpgrade pki-tools-debuginfoUpgrade jackson-databindNo solution existsUpgrade pki-core-debugsourceUpgrade apache-commons-net | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub