A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-nssUpgrade glassfish-fastinfosetUpgrade slf4j-jdk14Upgrade slf4jUpgrade jakarta-commons-httpclientUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade glassfish-jaxb-coreUpgrade velocityUpgrade jackson-annotationsUpgrade javassistUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-providersUpgrade pki-servlet-engineUpgrade pki-servlet-4.0-apiUpgrade xml-commons-apisUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade jackson-databindUpgrade jackson-coreUpgrade xalan-j2Upgrade resteasyUpgrade apache-commons-langUpgrade xsomUpgrade apache-commons-netUpgrade glassfish-jaxb-runtimeUpgrade bea-stax-apiUpgrade xerces-j2Upgrade xml-commons-resolver | May 4, 2022 | May 28, 2021 |
| Amazon Linux Ami 2 | — | Upgrade pki-toolsUpgrade pki-caUpgrade pki-javadocUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-core-debuginfoUpgrade pki-kraUpgrade pki-base | Apr 23, 2021 | Apr 23, 2021 |
| Centos_linux | — | Upgrade xerces-j2Upgrade python3-pkiUpgrade xmlstreambufferUpgrade relaxngDatatypeUpgrade pki-base-javaUpgrade jackson-jaxrs-json-providerUpgrade jackson-jaxrs-providersUpgrade jss-debugsourceUpgrade pki-kraUpgrade ldapjdkUpgrade pki-baseUpgrade pki-tools-debuginfoUpgrade resteasyUpgrade jackson-databindUpgrade xalan-j2Upgrade pki-serverUpgrade xml-commons-resolverUpgrade jackson-annotationsUpgrade jackson-coreUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debuginfoUpgrade bea-stax-apiUpgrade apache-commons-langUpgrade tomcatjssUpgrade velocityUpgrade pki-servlet-4.0-apiUpgrade jackson-module-jaxb-annotationsUpgrade slf4j-jdk14Upgrade jss-javadocUpgrade xml-commons-apisUpgrade apache-commons-netUpgrade pki-core-debugsourceUpgrade glassfish-fastinfosetUpgrade jssUpgrade javassistUpgrade slf4jUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade apache-commons-collectionsUpgrade python3-nss-debuginfoUpgrade pki-caUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade pki-toolsUpgrade pki-symkey-debuginfoUpgrade ldapjdk-javadocUpgrade jss-debuginfoUpgrade jakarta-commons-httpclientUpgrade xsomUpgrade python3-nssUpgrade pki-symkeyUpgrade pki-servlet-engineUpgrade pki-javadocUpgrade glassfish-jaxb-core | Mar 18, 2021 | Mar 15, 2021 |
| Debian | — | No solution exists | May 15, 2025 | May 28, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-kraUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-caUpgrade pki-toolsUpgrade pki-server | Sep 16, 2021 | May 28, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-symkeyUpgrade pki-caUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-serverUpgrade pki-kra | Apr 30, 2021 | Apr 30, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-symkeyUpgrade pki-baseUpgrade pki-toolsUpgrade pki-serverUpgrade pki-caUpgrade pki-base-javaUpgrade pki-kra | May 19, 2021 | Apr 30, 2021 |
| Oracle_linux | — | Upgrade pki-toolsUpgrade pki-caUpgrade pki-kraUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-javadocUpgrade pki-baseUpgrade pki-symkey | Mar 18, 2021 | Mar 2, 2021 |
| Redhat_linux | — | Upgrade pki-servlet-4.0-apiUpgrade apache-commons-netUpgrade pki-base-javaUpgrade pki-tools-debuginfoUpgrade pki-symkeyUpgrade xsomUpgrade glassfish-jaxb-txw2Upgrade pki-baseUpgrade pki-serverUpgrade python3-pkiUpgrade pki-caUpgrade glassfish-jaxb-coreUpgrade pki-core-debuginfoUpgrade xml-commons-resolverUpgrade pki-core-debugsourceUpgrade tomcatjssUpgrade glassfish-fastinfosetUpgrade ldapjdk-javadocUpgrade resteasyUpgrade javassistUpgrade jss-javadocUpgrade jss-debuginfoUpgrade xmlstreambufferUpgrade python3-nss-debuginfoUpgrade jakarta-commons-httpclientUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade jss-debugsourceUpgrade apache-commons-collectionsUpgrade xalan-j2Upgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade jssUpgrade jackson-databindUpgrade glassfish-jaxb-apiUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade pki-javadocUpgrade ldapjdkNo solution existsUpgrade python3-nssUpgrade apache-commons-langUpgrade python-nss-docUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade jackson-coreUpgrade bea-stax-apiUpgrade glassfish-jaxb-runtimeUpgrade python-nss-debugsourceUpgrade pki-toolsUpgrade pki-symkey-debuginfoUpgrade pki-servlet-engineUpgrade velocityUpgrade pki-kraUpgrade slf4j | Mar 18, 2021 | Mar 15, 2021 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python-nss-doc | Mar 12, 2024 | May 28, 2021 |
| Ubuntu | — | Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro)Upgrade pki-base-java (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro)Upgrade pki-ca (Ubuntu Pro) | Dec 11, 2024 | May 28, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub