A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xml-commons-resolverUpgrade python-nss-docUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade pki-servlet-4.0-apiUpgrade xmlstreambufferUpgrade stax-exUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade jackson-databindUpgrade jackson-coreUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade apache-commons-netUpgrade glassfish-jaxb-coreUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade apache-commons-langUpgrade jackson-annotationsUpgrade resteasyUpgrade pki-servlet-engineUpgrade apache-commons-collectionsUpgrade bea-stax-apiUpgrade xalan-j2Upgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade glassfish-fastinfosetUpgrade javassist | May 4, 2022 | Mar 18, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-baseUpgrade pki-base-javaUpgrade pki-core-debuginfoUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-caUpgrade pki-kraUpgrade pki-javadocUpgrade pki-tools | Apr 23, 2021 | Mar 18, 2020 |
| Centos_linux | — | Upgrade jakarta-commons-httpclientUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade xerces-j2Upgrade slf4j-jdk14Upgrade xml-commons-resolverUpgrade pki-core-debugsourceUpgrade jssUpgrade javassistUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade ldapjdk-javadocUpgrade bea-stax-apiUpgrade ldapjdkUpgrade python-nss-docUpgrade glassfish-jaxb-coreUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade jss-debuginfoUpgrade pki-tools-debuginfoUpgrade velocityUpgrade pki-baseUpgrade stax-exUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade jss-debugsourceUpgrade pki-kraUpgrade apache-commons-langUpgrade apache-commons-netUpgrade javassist-javadocUpgrade pki-symkey-debuginfoUpgrade slf4jUpgrade xalan-j2Upgrade jackson-jaxrs-json-providerUpgrade relaxngDatatypeUpgrade pki-javadocUpgrade xsomUpgrade pki-caUpgrade pki-serverUpgrade resteasyUpgrade jackson-coreUpgrade python3-pkiUpgrade python3-nss-debuginfoUpgrade pki-base-javaUpgrade python-nss-debugsourceUpgrade pki-toolsUpgrade jss-javadocUpgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade tomcatjss | Nov 5, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-baseUpgrade pki-serverUpgrade pki-caUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-kra | Feb 22, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-base-javaUpgrade pki-kraUpgrade pki-serverUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-caUpgrade pki-tools | Apr 30, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-symkeyUpgrade pki-baseUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-caUpgrade pki-tools | Dec 16, 2020 | Mar 18, 2020 |
| Oracle_linux | — | Upgrade velocityUpgrade pki-baseUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade python3-nssUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade apache-commons-collectionsUpgrade xerces-j2Upgrade bea-stax-apiUpgrade jssUpgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade ldapjdkUpgrade pki-symkeyUpgrade stax-exUpgrade javassist-javadocUpgrade slf4jUpgrade relaxngDatatypeUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade pki-kraUpgrade pki-base-javaUpgrade pki-servlet-4.0-apiUpgrade pki-serverUpgrade python3-pkiUpgrade jackson-databindUpgrade pki-servlet-engineUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade jackson-coreUpgrade pki-toolsUpgrade jss-javadocUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade xalan-j2Upgrade tomcatjssUpgrade apache-commons-netUpgrade pki-caUpgrade pki-javadoc | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade python3-nssUpgrade javassistUpgrade glassfish-jaxb-coreUpgrade pki-symkeyUpgrade apache-commons-netUpgrade pki-servlet-engineUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade pki-core-debuginfoUpgrade pki-servlet-4.0-apiUpgrade pki-base-javaUpgrade glassfish-jaxb-txw2Upgrade python-nss-docUpgrade jss-debuginfoUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade jssUpgrade jakarta-commons-httpclientUpgrade pki-core-debugsourceUpgrade pki-tools-debuginfoUpgrade xalan-j2Upgrade bea-stax-apiUpgrade ldapjdk-javadocUpgrade glassfish-fastinfosetUpgrade pki-baseUpgrade jackson-jaxrs-providersUpgrade jss-debugsourceUpgrade slf4j-jdk14Upgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade pki-toolsUpgrade pki-serverUpgrade slf4jUpgrade pki-kraUpgrade tomcatjssUpgrade apache-commons-langUpgrade pki-javadocUpgrade python3-pkiUpgrade xerces-j2Upgrade jackson-annotationsUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade jackson-databindUpgrade pki-caUpgrade velocityUpgrade jackson-coreUpgrade stax-exUpgrade xmlstreambufferUpgrade xsomUpgrade jss-javadocUpgrade glassfish-jaxb-runtimeUpgrade resteasyUpgrade jackson-jaxrs-json-providerUpgrade relaxngDatatypeUpgrade ldapjdkUpgrade pki-symkey-debuginfo | Nov 5, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-doc | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub