A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-nssUpgrade xerces-j2Upgrade xsomUpgrade stax-exUpgrade xmlstreambufferUpgrade jackson-databindUpgrade python-nss-docUpgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-apiUpgrade xalan-j2Upgrade apache-commons-netUpgrade pki-servlet-engineUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade jakarta-commons-httpclientUpgrade resteasyUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade velocityUpgrade glassfish-fastinfoset | May 4, 2022 | Mar 18, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-toolsUpgrade pki-kraUpgrade pki-javadocUpgrade pki-baseUpgrade pki-caUpgrade pki-core-debuginfoUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-symkey | Apr 23, 2021 | Mar 18, 2020 |
| Centos_linux | — | Upgrade jackson-databindUpgrade pki-servlet-4.0-apiUpgrade pki-base-javaUpgrade jackson-jaxrs-json-providerUpgrade jss-debugsourceUpgrade jackson-coreUpgrade pki-symkey-debuginfoUpgrade pki-toolsUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade javassist-javadocUpgrade xalan-j2Upgrade slf4jUpgrade apache-commons-netUpgrade python-nss-debugsourceUpgrade pki-caUpgrade python3-pkiUpgrade resteasyUpgrade xmlstreambufferUpgrade pki-kraUpgrade xsomUpgrade pki-javadocUpgrade glassfish-fastinfosetUpgrade jss-javadocUpgrade apache-commons-langUpgrade relaxngDatatypeUpgrade pki-serverUpgrade python3-nss-debuginfoUpgrade tomcatjssUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade bea-stax-apiUpgrade ldapjdkUpgrade ldapjdk-javadocUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade xerces-j2Upgrade jss-debuginfoUpgrade javassistUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade velocityUpgrade slf4j-jdk14Upgrade stax-exUpgrade pki-servlet-engineUpgrade pki-tools-debuginfoUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade jssUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2 | Nov 5, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-kraUpgrade pki-toolsUpgrade pki-caUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-base | Feb 22, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-serverUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-kraUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-ca | Apr 30, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-kraUpgrade pki-caUpgrade pki-toolsUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-symkey | Dec 16, 2020 | Mar 18, 2020 |
| Oracle_linux | — | Upgrade xalan-j2Upgrade jackson-jaxrs-json-providerUpgrade pki-javadocUpgrade jackson-jaxrs-providersUpgrade pki-servlet-engineUpgrade jackson-annotationsUpgrade xsomUpgrade xml-commons-apisUpgrade pki-serverUpgrade jss-javadocUpgrade pki-toolsUpgrade jackson-coreUpgrade glassfish-fastinfosetUpgrade apache-commons-netUpgrade jackson-module-jaxb-annotationsUpgrade pki-caUpgrade relaxngDatatypeUpgrade apache-commons-langUpgrade jackson-databindUpgrade pki-servlet-4.0-apiUpgrade python3-pkiUpgrade resteasyUpgrade tomcatjssUpgrade pki-base-javaUpgrade pki-kraUpgrade slf4jUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade ldapjdkUpgrade pki-baseUpgrade glassfish-jaxb-txw2Upgrade jssUpgrade javassist-javadocUpgrade xmlstreambufferUpgrade xml-commons-resolverUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade bea-stax-apiUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade python3-nssUpgrade pki-symkeyUpgrade glassfish-jaxb-runtimeUpgrade stax-exUpgrade javassistUpgrade velocityUpgrade xerces-j2 | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade tomcatjssUpgrade pki-symkey-debuginfoUpgrade jackson-coreUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade pki-caUpgrade python3-pkiUpgrade slf4jUpgrade pki-javadocUpgrade jackson-annotationsUpgrade xerces-j2Upgrade velocityUpgrade relaxngDatatypeUpgrade slf4j-jdk14Upgrade ldapjdkUpgrade xsomUpgrade pki-kraUpgrade python3-nss-debuginfoUpgrade pki-toolsUpgrade python-nss-debugsourceUpgrade pki-serverUpgrade jss-debugsourceUpgrade resteasyUpgrade jss-javadocUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade jssUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade apache-commons-netUpgrade pki-symkeyUpgrade javassistUpgrade pki-servlet-engineUpgrade python3-nssUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade pki-tools-debuginfoUpgrade pki-base-javaUpgrade jakarta-commons-httpclientUpgrade jss-debuginfoUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade pki-core-debuginfo | Nov 5, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsource | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub