A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade xalan-j2Upgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade bea-stax-apiUpgrade apache-commons-langUpgrade velocityUpgrade apache-commons-netUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-apiUpgrade apache-commons-collectionsUpgrade javassistUpgrade pki-servlet-engineUpgrade javassist-javadocUpgrade resteasyUpgrade glassfish-jaxb-txw2Upgrade jackson-annotationsUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade python-nss-docUpgrade jackson-coreUpgrade xerces-j2Upgrade xsomUpgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade xml-commons-resolverUpgrade jackson-jaxrs-providersUpgrade xmlstreambufferUpgrade stax-exUpgrade pki-servlet-4.0-api | May 4, 2022 | Mar 18, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-javadocUpgrade pki-toolsUpgrade pki-kraUpgrade pki-serverUpgrade pki-caUpgrade pki-core-debuginfoUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-symkey | Apr 23, 2021 | Mar 18, 2020 |
| Centos_linux | — | Upgrade jackson-databindUpgrade pki-caUpgrade jss-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade python3-nss-debuginfoUpgrade glassfish-fastinfosetUpgrade pki-kraUpgrade pki-symkey-debuginfoUpgrade xalan-j2Upgrade javassist-javadocUpgrade apache-commons-netUpgrade jss-javadocUpgrade tomcatjssUpgrade apache-commons-langUpgrade slf4jUpgrade jackson-coreUpgrade xsomUpgrade pki-javadocUpgrade python3-pkiUpgrade pki-servlet-4.0-apiUpgrade python-nss-debugsourceUpgrade pki-serverUpgrade jackson-module-jaxb-annotationsUpgrade xmlstreambufferUpgrade pki-toolsUpgrade jackson-annotationsUpgrade resteasyUpgrade jackson-jaxrs-json-providerUpgrade pki-base-javaUpgrade jssUpgrade apache-commons-collectionsUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade pki-tools-debuginfoUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade glassfish-jaxb-coreUpgrade ldapjdk-javadocUpgrade python3-nssUpgrade glassfish-jaxb-apiUpgrade pki-core-debugsourceUpgrade xml-commons-resolverUpgrade javassistUpgrade python-nss-docUpgrade pki-core-debuginfoUpgrade pki-servlet-engineUpgrade jss-debuginfoUpgrade stax-exUpgrade pki-baseUpgrade bea-stax-apiUpgrade velocityUpgrade pki-symkeyUpgrade ldapjdk | Nov 5, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-baseUpgrade pki-toolsUpgrade pki-kraUpgrade pki-serverUpgrade pki-caUpgrade pki-symkey | Feb 22, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-toolsUpgrade pki-symkeyUpgrade pki-caUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-kraUpgrade pki-server | Apr 30, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-baseUpgrade pki-symkeyUpgrade pki-kraUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-toolsUpgrade pki-ca | Dec 16, 2020 | Mar 18, 2020 |
| Oracle_linux | — | Upgrade glassfish-jaxb-runtimeUpgrade python3-nssUpgrade javassistUpgrade bea-stax-apiUpgrade ldapjdkUpgrade pki-symkeyUpgrade stax-exUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade velocityUpgrade python-nss-docUpgrade pki-baseUpgrade ldapjdk-javadocUpgrade xerces-j2Upgrade jssUpgrade javassist-javadocUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade pki-serverUpgrade xalan-j2Upgrade xsomUpgrade tomcatjssUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-engineUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade relaxngDatatypeUpgrade resteasyUpgrade pki-caUpgrade pki-kraUpgrade apache-commons-langUpgrade pki-base-javaUpgrade pki-servlet-4.0-apiUpgrade jackson-annotationsUpgrade python3-pkiUpgrade pki-javadocUpgrade jackson-databindUpgrade slf4jUpgrade pki-toolsUpgrade apache-commons-netUpgrade jackson-jaxrs-providersUpgrade glassfish-fastinfosetUpgrade jackson-coreUpgrade jss-javadoc | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade xalan-j2Upgrade javassistUpgrade ldapjdk-javadocUpgrade pki-tools-debuginfoUpgrade jss-debuginfoUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade apache-commons-netUpgrade glassfish-fastinfosetUpgrade pki-baseUpgrade python3-nssUpgrade bea-stax-apiUpgrade pki-core-debugsourceUpgrade javassist-javadocUpgrade pki-symkeyUpgrade glassfish-jaxb-coreUpgrade pki-servlet-engineUpgrade apache-commons-collectionsUpgrade jssUpgrade python-nss-docUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade pki-base-javaUpgrade xml-commons-resolverUpgrade pki-serverUpgrade jss-debugsourceUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade resteasyUpgrade jss-javadocUpgrade stax-exUpgrade xmlstreambufferUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade pki-caUpgrade xml-commons-apisUpgrade tomcatjssUpgrade pki-symkey-debuginfoUpgrade slf4jUpgrade ldapjdkUpgrade apache-commons-langUpgrade python3-nss-debuginfoUpgrade velocityUpgrade pki-javadocUpgrade pki-kraUpgrade xsomUpgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade xerces-j2Upgrade jackson-databindUpgrade python3-pkiUpgrade pki-toolsUpgrade slf4j-jdk14Upgrade jackson-jaxrs-json-provider | Nov 5, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nssUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub