A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade slf4jUpgrade velocityUpgrade glassfish-jaxb-txw2Upgrade apache-commons-netUpgrade resteasyUpgrade javassist-javadocUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade javassistUpgrade glassfish-jaxb-coreUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade xalan-j2Upgrade jakarta-commons-httpclientUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade jackson-databindUpgrade jackson-coreUpgrade xsomUpgrade xerces-j2Upgrade xmlstreambufferUpgrade stax-exUpgrade python3-nssUpgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-runtime | May 4, 2022 | Mar 18, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-toolsUpgrade pki-javadocUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-caUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade pki-base-java | Apr 23, 2021 | Mar 18, 2020 |
| Centos_linux | — | Upgrade pki-baseUpgrade jss-debuginfoUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade pki-core-debugsourceUpgrade velocityUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade jakarta-commons-httpclientUpgrade jssUpgrade apache-commons-collectionsUpgrade pki-symkeyUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-providersUpgrade stax-exUpgrade pki-core-debuginfoUpgrade python3-nssUpgrade javassistUpgrade ldapjdkUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade ldapjdk-javadocUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade relaxngDatatypeUpgrade jss-debugsourceUpgrade pki-kraUpgrade glassfish-fastinfosetUpgrade apache-commons-netUpgrade slf4jUpgrade jss-javadocUpgrade pki-javadocUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade jackson-jaxrs-json-providerUpgrade pki-caUpgrade python-nss-debugsourceUpgrade resteasyUpgrade javassist-javadocUpgrade python3-pkiUpgrade tomcatjssUpgrade jackson-coreUpgrade python3-nss-debuginfoUpgrade pki-servlet-4.0-apiUpgrade pki-base-javaUpgrade jackson-databindUpgrade jackson-annotationsUpgrade pki-toolsUpgrade xsomUpgrade pki-serverUpgrade glassfish-jaxb-runtimeUpgrade pki-symkey-debuginfoUpgrade xmlstreambuffer | Nov 5, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-serverUpgrade pki-caUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-kraUpgrade pki-base | Feb 22, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-symkeyUpgrade pki-caUpgrade pki-toolsUpgrade pki-kraUpgrade pki-serverUpgrade pki-baseUpgrade pki-base-java | Apr 30, 2021 | Mar 18, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-base-javaUpgrade pki-caUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-base | Dec 16, 2020 | Mar 18, 2020 |
| Oracle_linux | — | Upgrade bea-stax-apiUpgrade xmlstreambufferUpgrade jssUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade glassfish-jaxb-runtimeUpgrade jakarta-commons-httpclientUpgrade pki-symkeyUpgrade python3-nssUpgrade javassist-javadocUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade velocityUpgrade stax-exUpgrade python-nss-docUpgrade pki-baseUpgrade apache-commons-collectionsUpgrade xerces-j2Upgrade glassfish-jaxb-coreUpgrade slf4j-jdk14Upgrade xml-commons-resolverUpgrade ldapjdkUpgrade jackson-module-jaxb-annotationsUpgrade pki-caUpgrade apache-commons-netUpgrade jackson-databindUpgrade pki-kraUpgrade pki-servlet-4.0-apiUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade pki-toolsUpgrade pki-serverUpgrade relaxngDatatypeUpgrade pki-javadocUpgrade tomcatjssUpgrade jss-javadocUpgrade resteasyUpgrade slf4jUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade pki-base-javaUpgrade xalan-j2Upgrade pki-servlet-engineUpgrade xsomUpgrade jackson-coreUpgrade jackson-jaxrs-json-providerUpgrade python3-pki | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade jssUpgrade javassistUpgrade pki-servlet-engineUpgrade python-nss-docUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade pki-base-javaUpgrade jss-debuginfoUpgrade apache-commons-netUpgrade bea-stax-apiUpgrade glassfish-fastinfosetUpgrade pki-baseUpgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade pki-tools-debuginfoUpgrade pki-servlet-4.0-apiUpgrade pki-symkeyUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade pki-core-debugsourceUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade stax-exUpgrade jss-javadocUpgrade xsomUpgrade ldapjdkUpgrade pki-symkey-debuginfoUpgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade slf4j-jdk14Upgrade jackson-databindUpgrade pki-javadocUpgrade jss-debugsourceUpgrade pki-toolsUpgrade jackson-jaxrs-json-providerUpgrade pki-kraUpgrade jackson-coreUpgrade resteasyUpgrade tomcatjssUpgrade pki-caUpgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade pki-serverUpgrade python3-nss-debuginfoUpgrade apache-commons-langUpgrade xerces-j2Upgrade jackson-annotationsUpgrade velocityUpgrade python3-pkiUpgrade slf4jUpgrade jackson-jaxrs-providers | Nov 5, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub