A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade jackson-coreUpgrade xsomUpgrade xalan-j2Upgrade jackson-annotationsUpgrade apache-commons-netUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-providersUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade pki-servlet-engineUpgrade velocityUpgrade glassfish-jaxb-coreUpgrade xmlstreambufferUpgrade apache-commons-collectionsUpgrade javassistUpgrade slf4j-jdk14Upgrade bea-stax-apiUpgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade xerces-j2Upgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade python-nss-docUpgrade python3-nssUpgrade jackson-databindUpgrade stax-ex | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-caUpgrade pki-serverUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-javadoc | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade python3-nssUpgrade pki-kraUpgrade ldapjdkUpgrade xml-commons-apisUpgrade pki-servlet-engineUpgrade pki-symkeyUpgrade xerces-j2Upgrade glassfish-jaxb-apiUpgrade pki-symkey-debuginfoUpgrade velocityUpgrade slf4j-jdk14Upgrade jackson-databindUpgrade stax-exUpgrade python-nss-docUpgrade pki-javadocUpgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade pki-tools-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade jss-debuginfoUpgrade apache-commons-collectionsUpgrade jssUpgrade jackson-coreUpgrade glassfish-jaxb-txw2Upgrade resteasyUpgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade ldapjdk-javadocUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-toolsUpgrade glassfish-jaxb-runtimeUpgrade python-nss-debugsourceUpgrade xalan-j2Upgrade pki-serverUpgrade xmlstreambufferUpgrade slf4jUpgrade xsomUpgrade apache-commons-langUpgrade python3-nss-debuginfoUpgrade relaxngDatatypeUpgrade glassfish-jaxb-coreUpgrade jackson-annotationsUpgrade jss-javadocUpgrade glassfish-fastinfosetUpgrade tomcatjssUpgrade python3-pkiUpgrade pki-core-debuginfoUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade apache-commons-netUpgrade pki-caUpgrade javassistUpgrade jss-debugsourceUpgrade pki-core-debugsourceUpgrade jackson-module-jaxb-annotations | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-kraUpgrade pki-serverUpgrade pki-caUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-tools | Feb 22, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-caUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-base | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-toolsUpgrade pki-symkeyUpgrade pki-caUpgrade pki-kraUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-base | Dec 16, 2020 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade xerces-j2Upgrade python-nss-docUpgrade stax-exUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade python3-nssUpgrade pki-baseUpgrade pki-symkeyUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-engineUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade ldapjdkUpgrade velocityUpgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade python3-pkiUpgrade javassist-javadocUpgrade pki-servlet-4.0-apiUpgrade pki-base-javaUpgrade apache-commons-netUpgrade javassistUpgrade slf4jUpgrade jssUpgrade xml-commons-apisUpgrade tomcatjssUpgrade pki-serverUpgrade pki-caUpgrade ldapjdk-javadocUpgrade resteasyUpgrade relaxngDatatypeUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade jss-javadocUpgrade pki-javadocUpgrade xsomUpgrade pki-toolsUpgrade apache-commons-langUpgrade pki-kraUpgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotations | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade pki-servlet-engineUpgrade jackson-jaxrs-providersUpgrade pki-tools-debuginfoUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade ldapjdkUpgrade apache-commons-collectionsUpgrade bea-stax-apiUpgrade stax-exUpgrade pki-symkey-debuginfoUpgrade apache-commons-langUpgrade resteasyUpgrade jss-javadocUpgrade pki-base-javaUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade tomcatjssUpgrade javassistUpgrade ldapjdk-javadocUpgrade slf4j-jdk14Upgrade python3-pkiUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade pki-javadocUpgrade python3-nssUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade pki-symkeyUpgrade xerces-j2Upgrade relaxngDatatypeUpgrade pki-core-debuginfoUpgrade xml-commons-resolverUpgrade jackson-coreUpgrade pki-kraUpgrade pki-baseUpgrade javassist-javadocUpgrade jss-debuginfoUpgrade xalan-j2Upgrade python-nss-debugsourceUpgrade jss-debugsourceUpgrade jackson-databindUpgrade python-nss-docUpgrade pki-caUpgrade glassfish-jaxb-txw2Upgrade pki-core-debugsourceUpgrade slf4jUpgrade xmlstreambufferUpgrade apache-commons-netUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-json-providerUpgrade jackson-annotationsUpgrade pki-serverUpgrade python3-nss-debuginfoUpgrade jssUpgrade pki-toolsUpgrade xsom | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nssUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub