A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-providersUpgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-json-providerUpgrade slf4jUpgrade resteasyUpgrade pki-servlet-engineUpgrade jackson-coreUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade apache-commons-netUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade xml-commons-apisUpgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade xerces-j2Upgrade apache-commons-collectionsUpgrade velocityUpgrade stax-exUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade javassist-javadocUpgrade python3-nssUpgrade jackson-databindUpgrade xmlstreambufferUpgrade xml-commons-resolver | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-caUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade pki-serverUpgrade pki-javadocUpgrade pki-base-javaUpgrade pki-kra | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade ldapjdk-javadocUpgrade pki-base-javaUpgrade pki-toolsUpgrade tomcatjssUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-runtimeUpgrade python3-pkiUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade pki-core-debugsourceUpgrade glassfish-jaxb-txw2Upgrade resteasyUpgrade pki-baseUpgrade javassist-javadocUpgrade pki-core-debuginfoUpgrade relaxngDatatypeUpgrade xsomUpgrade pki-serverUpgrade apache-commons-netUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade pki-caUpgrade jss-debugsourceUpgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade python-nss-debugsourceUpgrade xmlstreambufferUpgrade jss-javadocUpgrade python3-nss-debuginfoUpgrade jackson-annotationsUpgrade javassistUpgrade pki-kraUpgrade jssUpgrade pki-tools-debuginfoUpgrade velocityUpgrade python-nss-docUpgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade jackson-coreUpgrade apache-commons-collectionsUpgrade ldapjdkUpgrade pki-symkeyUpgrade pki-servlet-engineUpgrade xerces-j2Upgrade jss-debuginfoUpgrade pki-symkey-debuginfoUpgrade xml-commons-apisUpgrade jackson-databindUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade jackson-jaxrs-json-providerUpgrade pki-javadocUpgrade python3-nss | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-symkeyUpgrade pki-toolsUpgrade pki-baseUpgrade pki-caUpgrade pki-kraUpgrade pki-server | Feb 22, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-serverUpgrade pki-base-javaUpgrade pki-caUpgrade pki-toolsUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-base | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-kraUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-serverUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-ca | Dec 16, 2020 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade pki-serverUpgrade xml-commons-apisUpgrade resteasyUpgrade pki-toolsUpgrade ldapjdk-javadocUpgrade jackson-annotationsUpgrade relaxngDatatypeUpgrade xalan-j2Upgrade apache-commons-langUpgrade pki-caUpgrade jakarta-commons-httpclientUpgrade xsomUpgrade javassistUpgrade pki-base-javaUpgrade pki-kraUpgrade apache-commons-netUpgrade tomcatjssUpgrade jss-javadocUpgrade slf4jUpgrade jssUpgrade pki-javadocUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade pki-servlet-4.0-apiUpgrade pki-servlet-engineUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-apiUpgrade xml-commons-resolverUpgrade ldapjdkUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade xmlstreambufferUpgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade python3-pkiUpgrade apache-commons-collectionsUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade bea-stax-apiUpgrade stax-exUpgrade jackson-coreUpgrade python3-nssUpgrade glassfish-jaxb-runtimeUpgrade velocityUpgrade pki-baseUpgrade jackson-jaxrs-json-providerUpgrade pki-symkey | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade jss-debuginfoUpgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade jackson-coreUpgrade python-nss-debugsourceUpgrade pki-kraUpgrade jssUpgrade jackson-annotationsUpgrade xsomUpgrade python3-nss-debuginfoUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade python-nss-docUpgrade jss-debugsourceUpgrade pki-symkeyUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade apache-commons-netUpgrade pki-toolsUpgrade xml-commons-apisUpgrade pki-core-debuginfoUpgrade pki-caUpgrade xml-commons-resolverUpgrade xerces-j2Upgrade pki-serverUpgrade slf4jUpgrade relaxngDatatypeUpgrade pki-servlet-4.0-apiUpgrade xalan-j2Upgrade glassfish-jaxb-runtimeUpgrade bea-stax-apiUpgrade stax-exUpgrade glassfish-fastinfosetUpgrade pki-tools-debuginfoUpgrade ldapjdk-javadocUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-collectionsUpgrade pki-base-javaUpgrade pki-servlet-engineUpgrade glassfish-jaxb-coreUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade javassistUpgrade jss-javadocUpgrade tomcatjssUpgrade jakarta-commons-httpclientUpgrade python3-pkiUpgrade resteasyUpgrade apache-commons-langUpgrade velocityUpgrade pki-javadocUpgrade pki-symkey-debuginfoUpgrade ldapjdkUpgrade jackson-jaxrs-providers | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub