A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python-nss-docUpgrade resteasyUpgrade velocityUpgrade slf4j-jdk14Upgrade jackson-databindUpgrade stax-exUpgrade xsomUpgrade python3-nssUpgrade slf4jUpgrade xerces-j2Upgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade jackson-annotationsUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade jackson-coreUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade xalan-j2Upgrade pki-servlet-engineUpgrade apache-commons-collectionsUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade glassfish-fastinfosetUpgrade apache-commons-netUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-api | May 4, 2022 | Apr 30, 2021 |
| Amazon Linux Ami 2 | — | Upgrade pki-caUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-kraUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade pki-serverUpgrade pki-javadocUpgrade pki-base-java | Apr 23, 2021 | Apr 23, 2021 |
| Centos_linux | — | Upgrade bea-stax-apiUpgrade pki-servlet-engineUpgrade pki-kraUpgrade pki-symkey-debuginfoUpgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade python3-nssUpgrade ldapjdkUpgrade jss-debuginfoUpgrade velocityUpgrade pki-symkeyUpgrade apache-commons-collectionsUpgrade jackson-databindUpgrade pki-javadocUpgrade pki-tools-debuginfoUpgrade xmlstreambufferUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade jssUpgrade slf4jUpgrade pki-core-debuginfoUpgrade pki-caUpgrade javassist-javadocUpgrade python3-pkiUpgrade relaxngDatatypeUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade pki-toolsUpgrade jss-javadocUpgrade jss-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-netUpgrade xml-commons-apisUpgrade pki-base-javaUpgrade python-nss-debugsourceUpgrade pki-baseUpgrade resteasyUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade xsomUpgrade tomcatjssUpgrade javassistUpgrade pki-core-debugsourceUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade pki-serverUpgrade ldapjdk-javadocUpgrade jakarta-commons-httpclientUpgrade python3-nss-debuginfo | Nov 5, 2020 | Nov 3, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Apr 30, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-serverUpgrade pki-baseUpgrade pki-kraUpgrade pki-caUpgrade pki-toolsUpgrade pki-symkey | Feb 22, 2021 | Oct 30, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-caUpgrade pki-toolsUpgrade pki-symkey | Apr 30, 2021 | Oct 30, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-base-javaUpgrade pki-serverUpgrade pki-kraUpgrade pki-toolsUpgrade pki-baseUpgrade pki-caUpgrade pki-symkey | Nov 2, 2020 | Oct 30, 2020 |
| Oracle_linux | — | Upgrade jss-javadocUpgrade jackson-annotationsUpgrade pki-base-javaUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade ldapjdkUpgrade stax-exUpgrade xmlstreambufferUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade xalan-j2Upgrade ldapjdk-javadocUpgrade pki-serverUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-coreUpgrade resteasyUpgrade javassist-javadocUpgrade xml-commons-apisUpgrade tomcatjssUpgrade apache-commons-langUpgrade javassistUpgrade python3-pkiUpgrade bea-stax-apiUpgrade relaxngDatatypeUpgrade pki-javadocUpgrade xerces-j2Upgrade velocityUpgrade pki-toolsUpgrade pki-caUpgrade pki-kraUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade glassfish-jaxb-txw2Upgrade python-nss-docUpgrade pki-baseUpgrade jackson-databindUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade slf4jUpgrade pki-symkeyUpgrade jackson-coreUpgrade xsomUpgrade slf4j-jdk14Upgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-providersUpgrade jssUpgrade apache-commons-netUpgrade glassfish-jaxb-runtime | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade xml-commons-apisUpgrade python-nss-debugsourceUpgrade jackson-annotationsUpgrade xerces-j2Upgrade python3-nss-debuginfoUpgrade jackson-coreUpgrade jackson-databindUpgrade xalan-j2Upgrade ldapjdkUpgrade slf4j-jdk14Upgrade jss-javadocUpgrade glassfish-jaxb-runtimeUpgrade pki-serverUpgrade pki-kraUpgrade jackson-jaxrs-providersUpgrade pki-base-javaUpgrade pki-symkey-debuginfoUpgrade stax-exUpgrade slf4jUpgrade pki-javadocUpgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-apiUpgrade tomcatjssUpgrade jss-debugsourceUpgrade resteasyUpgrade xmlstreambufferUpgrade pki-toolsUpgrade apache-commons-langUpgrade xsomUpgrade python3-pkiUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade ldapjdk-javadocUpgrade apache-commons-netUpgrade pki-symkeyUpgrade glassfish-jaxb-coreUpgrade pki-core-debugsourceUpgrade pki-tools-debuginfoUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade velocityUpgrade pki-baseUpgrade python3-nssUpgrade javassistUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade bea-stax-apiUpgrade pki-caUpgrade jss-debuginfoUpgrade jssUpgrade python-nss-docUpgrade pki-core-debuginfoUpgrade pki-servlet-engine | Nov 5, 2020 | Nov 3, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python3-nssUpgrade python-nss-doc | Mar 12, 2024 | Apr 30, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 30, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub