A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade slf4j-jdk14Upgrade python-nss-docUpgrade xml-commons-resolverUpgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-4.0-apiUpgrade stax-exUpgrade jackson-coreUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade apache-commons-langUpgrade slf4jUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade javassist-javadocUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade apache-commons-netUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade bea-stax-apiUpgrade jackson-annotationsUpgrade resteasyUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-core | May 4, 2022 | Mar 18, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-core-debuginfoUpgrade pki-serverUpgrade pki-baseUpgrade pki-caUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-javadocUpgrade pki-kra | Apr 23, 2021 | Mar 18, 2020 |
| Centos_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade apache-commons-langUpgrade slf4jUpgrade apache-commons-netUpgrade jss-javadocUpgrade xml-commons-apisUpgrade pki-toolsUpgrade python-nss-debugsourceUpgrade pki-kraUpgrade resteasyUpgrade xalan-j2Upgrade xsomUpgrade pki-javadocUpgrade jackson-coreUpgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade tomcatjssUpgrade glassfish-fastinfosetUpgrade jackson-databindUpgrade jackson-annotationsUpgrade pki-symkey-debuginfoUpgrade pki-serverUpgrade jackson-module-jaxb-annotationsUpgrade python3-nss-debuginfoUpgrade jss-debugsourceUpgrade pki-base-javaUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade python3-pkiUpgrade pki-core-debugsourceUpgrade xml-commons-resolverUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade python-nss-docUpgrade stax-exUpgrade pki-tools-debuginfoUpgrade slf4j-jdk14Upgrade python3-nssUpgrade apache-commons-collectionsUpgrade jakarta-commons-httpclientUpgrade ldapjdkUpgrade glassfish-jaxb-coreUpgrade jssUpgrade glassfish-jaxb-txw2Upgrade ldapjdk-javadocUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade jss-debuginfoUpgrade jackson-jaxrs-providersUpgrade velocityUpgrade javassistUpgrade xerces-j2 | Nov 5, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-baseUpgrade pki-symkeyUpgrade pki-kraUpgrade pki-serverUpgrade pki-caUpgrade pki-tools | Feb 22, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-baseUpgrade pki-base-javaUpgrade pki-caUpgrade pki-symkeyUpgrade pki-tools | Apr 30, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-serverUpgrade pki-base-javaUpgrade pki-caUpgrade pki-toolsUpgrade pki-kraUpgrade pki-baseUpgrade pki-symkey | Dec 16, 2020 | Mar 18, 2020 |
| Oracle_linux | — | Upgrade pki-servlet-engineUpgrade pki-base-javaUpgrade relaxngDatatypeUpgrade jackson-coreUpgrade apache-commons-netUpgrade jackson-jaxrs-providersUpgrade pki-serverUpgrade pki-toolsUpgrade pki-caUpgrade apache-commons-langUpgrade pki-servlet-4.0-apiUpgrade jss-javadocUpgrade pki-kraUpgrade jackson-databindUpgrade python3-pkiUpgrade xml-commons-apisUpgrade resteasyUpgrade pki-javadocUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade xsomUpgrade jackson-jaxrs-json-providerUpgrade xalan-j2Upgrade tomcatjssUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-runtimeUpgrade python-nss-docUpgrade jssUpgrade xmlstreambufferUpgrade pki-baseUpgrade jakarta-commons-httpclientUpgrade python3-nssUpgrade javassistUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade ldapjdk-javadocUpgrade ldapjdkUpgrade velocityUpgrade javassist-javadocUpgrade pki-symkeyUpgrade stax-exUpgrade xml-commons-resolverUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade bea-stax-apiUpgrade glassfish-jaxb-txw2 | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade jackson-coreUpgrade stax-exUpgrade jackson-jaxrs-json-providerUpgrade pki-toolsUpgrade ldapjdkUpgrade jss-javadocUpgrade xml-commons-apisUpgrade pki-caUpgrade pki-kraUpgrade jackson-module-jaxb-annotationsUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade pki-symkey-debuginfoUpgrade jss-debugsourceUpgrade python3-pkiUpgrade jackson-annotationsUpgrade relaxngDatatypeUpgrade jackson-databindUpgrade apache-commons-langUpgrade resteasyUpgrade python3-nss-debuginfoUpgrade slf4jUpgrade xerces-j2Upgrade xmlstreambufferUpgrade tomcatjssUpgrade python-nss-debugsourceUpgrade velocityUpgrade pki-javadocUpgrade pki-serverUpgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade pki-tools-debuginfoUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade pki-core-debuginfoUpgrade jssUpgrade python-nss-docUpgrade apache-commons-netUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade javassist-javadocUpgrade ldapjdk-javadocUpgrade python3-nssUpgrade pki-core-debugsourceUpgrade pki-base-javaUpgrade pki-baseUpgrade glassfish-jaxb-apiUpgrade jss-debuginfoUpgrade glassfish-fastinfosetUpgrade pki-servlet-engineUpgrade xalan-j2Upgrade bea-stax-apiUpgrade pki-symkey | Nov 5, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python3-nss | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub