A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade javassistUpgrade apache-commons-netUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-apiUpgrade apache-commons-collectionsUpgrade slf4jUpgrade xalan-j2Upgrade pki-servlet-engineUpgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade javassist-javadocUpgrade velocityUpgrade bea-stax-apiUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade resteasyUpgrade xsomUpgrade xml-commons-apisUpgrade jackson-coreUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade pki-servlet-4.0-apiUpgrade xmlstreambufferUpgrade python3-nssUpgrade python-nss-docUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade xml-commons-resolver | May 4, 2022 | Mar 18, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-javadocUpgrade pki-kraUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade pki-caUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-base-java | Apr 23, 2021 | Mar 18, 2020 |
| Centos_linux | — | Upgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-json-providerUpgrade jss-debugsourceUpgrade relaxngDatatypeUpgrade pki-kraUpgrade glassfish-fastinfosetUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade tomcatjssUpgrade apache-commons-langUpgrade python3-nss-debuginfoUpgrade pki-toolsUpgrade pki-javadocUpgrade python3-pkiUpgrade slf4jUpgrade jss-javadocUpgrade apache-commons-netUpgrade resteasyUpgrade pki-caUpgrade python-nss-debugsourceUpgrade jackson-databindUpgrade xalan-j2Upgrade jackson-coreUpgrade pki-serverUpgrade javassist-javadocUpgrade pki-symkey-debuginfoUpgrade pki-base-javaUpgrade xsomUpgrade jss-debuginfoUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade pki-servlet-engineUpgrade bea-stax-apiUpgrade jssUpgrade ldapjdk-javadocUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade pki-baseUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-apiUpgrade stax-exUpgrade ldapjdkUpgrade pki-tools-debuginfoUpgrade python3-nssUpgrade pki-core-debugsourceUpgrade jackson-jaxrs-providersUpgrade xml-commons-resolverUpgrade xerces-j2Upgrade slf4j-jdk14 | Nov 5, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-baseUpgrade pki-caUpgrade pki-kraUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-tools | Feb 22, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-base-javaUpgrade pki-serverUpgrade pki-kraUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-ca | Apr 30, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-caUpgrade pki-serverUpgrade pki-kraUpgrade pki-base-javaUpgrade pki-toolsUpgrade pki-baseUpgrade pki-symkey | Dec 16, 2020 | Mar 18, 2020 |
| Oracle_linux | — | Upgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade ldapjdkUpgrade jssUpgrade python-nss-docUpgrade bea-stax-apiUpgrade pki-baseUpgrade stax-exUpgrade pki-symkeyUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade python3-nssUpgrade velocityUpgrade slf4j-jdk14Upgrade javassistUpgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade glassfish-fastinfosetUpgrade pki-base-javaUpgrade jss-javadocUpgrade apache-commons-netUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade tomcatjssUpgrade pki-serverUpgrade resteasyUpgrade relaxngDatatypeUpgrade pki-javadocUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-engineUpgrade jackson-annotationsUpgrade pki-toolsUpgrade xalan-j2Upgrade xsomUpgrade slf4jUpgrade jackson-databindUpgrade python3-pkiUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade jackson-module-jaxb-annotationsUpgrade pki-caUpgrade apache-commons-langUpgrade pki-kra | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade python-nss-docUpgrade jssUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade pki-servlet-engineUpgrade pki-base-javaUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade pki-core-debugsourceUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade pki-tools-debuginfoUpgrade glassfish-jaxb-txw2Upgrade apache-commons-netUpgrade pki-servlet-4.0-apiUpgrade ldapjdk-javadocUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade jss-debuginfoUpgrade pki-baseUpgrade pki-symkeyUpgrade python3-nssUpgrade bea-stax-apiUpgrade velocityUpgrade python3-pkiUpgrade jackson-module-jaxb-annotationsUpgrade pki-caUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade stax-exUpgrade pki-serverUpgrade python3-nss-debuginfoUpgrade jackson-annotationsUpgrade python-nss-debugsourceUpgrade xerces-j2Upgrade pki-kraUpgrade jackson-jaxrs-providersUpgrade apache-commons-langUpgrade jss-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade slf4j-jdk14Upgrade pki-javadocUpgrade pki-toolsUpgrade xml-commons-apisUpgrade pki-symkey-debuginfoUpgrade tomcatjssUpgrade slf4jUpgrade ldapjdkUpgrade relaxngDatatypeUpgrade resteasyUpgrade jackson-coreUpgrade xmlstreambufferUpgrade jss-javadoc | Nov 5, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub