A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade slf4jUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade apache-commons-langUpgrade xalan-j2Upgrade jackson-coreUpgrade pki-servlet-engineUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade glassfish-fastinfosetUpgrade apache-commons-netUpgrade resteasyUpgrade javassist-javadocUpgrade xmlstreambufferUpgrade stax-exUpgrade xerces-j2Upgrade jackson-databindUpgrade python-nss-docUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade python3-nssUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade velocityUpgrade slf4j-jdk14 | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-serverUpgrade pki-caUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-baseUpgrade pki-kraUpgrade pki-javadocUpgrade pki-base-java | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade jackson-jaxrs-providersUpgrade apache-commons-collectionsUpgrade pki-tools-debuginfoUpgrade python-nss-docUpgrade pki-javadocUpgrade jackson-jaxrs-json-providerUpgrade jssUpgrade slf4j-jdk14Upgrade pki-kraUpgrade ldapjdkUpgrade pki-servlet-engineUpgrade jss-debuginfoUpgrade pki-symkey-debuginfoUpgrade xerces-j2Upgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade xml-commons-apisUpgrade pki-symkeyUpgrade jackson-databindUpgrade stax-exUpgrade python3-nssUpgrade velocityUpgrade jackson-coreUpgrade tomcatjssUpgrade javassistUpgrade apache-commons-netUpgrade ldapjdk-javadocUpgrade jakarta-commons-httpclientUpgrade apache-commons-langUpgrade xalan-j2Upgrade pki-toolsUpgrade xsomUpgrade python3-pkiUpgrade xmlstreambufferUpgrade slf4jUpgrade resteasyUpgrade glassfish-jaxb-txw2Upgrade pki-base-javaUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debugsourceUpgrade jss-javadocUpgrade xml-commons-resolverUpgrade pki-core-debuginfoUpgrade pki-caUpgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-4.0-apiUpgrade pki-serverUpgrade jackson-annotationsUpgrade python3-nss-debuginfoUpgrade pki-baseUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade jss-debugsourceUpgrade python-nss-debugsourceUpgrade glassfish-fastinfoset | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-caUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-tools | Feb 22, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-baseUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-caUpgrade pki-serverUpgrade pki-tools | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-kraUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-serverUpgrade pki-caUpgrade pki-symkeyUpgrade pki-tools | Dec 16, 2020 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade python-nss-docUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade ldapjdkUpgrade velocityUpgrade xmlstreambufferUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade pki-symkeyUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade pki-baseUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade python3-pkiUpgrade python3-nssUpgrade pki-servlet-engineUpgrade stax-exUpgrade bea-stax-apiUpgrade xerces-j2Upgrade jackson-coreUpgrade xml-commons-apisUpgrade pki-toolsUpgrade jss-javadocUpgrade pki-base-javaUpgrade pki-serverUpgrade jackson-module-jaxb-annotationsUpgrade javassistUpgrade tomcatjssUpgrade apache-commons-netUpgrade pki-caUpgrade ldapjdk-javadocUpgrade pki-javadocUpgrade jssUpgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade pki-kraUpgrade jackson-annotationsUpgrade xsomUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade relaxngDatatypeUpgrade xalan-j2Upgrade pki-servlet-4.0-apiUpgrade slf4jUpgrade resteasy | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade pki-tools-debuginfoUpgrade pki-base-javaUpgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade pki-symkey-debuginfoUpgrade ldapjdkUpgrade glassfish-jaxb-coreUpgrade resteasyUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade stax-exUpgrade pki-servlet-engineUpgrade velocityUpgrade pki-javadocUpgrade python3-pkiUpgrade glassfish-jaxb-apiUpgrade tomcatjssUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade ldapjdk-javadocUpgrade jss-javadocUpgrade javassistUpgrade apache-commons-collectionsUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-txw2Upgrade pki-core-debugsourceUpgrade xalan-j2Upgrade python3-nssUpgrade apache-commons-netUpgrade jackson-coreUpgrade jssUpgrade glassfish-jaxb-runtimeUpgrade pki-kraUpgrade xerces-j2Upgrade pki-serverUpgrade jss-debugsourceUpgrade jackson-databindUpgrade python-nss-docUpgrade pki-toolsUpgrade jss-debuginfoUpgrade pki-baseUpgrade pki-symkeyUpgrade python3-nss-debuginfoUpgrade relaxngDatatypeUpgrade xml-commons-resolverUpgrade jackson-annotationsUpgrade pki-core-debuginfoUpgrade xml-commons-apisUpgrade xsomUpgrade pki-servlet-4.0-apiUpgrade slf4jUpgrade xmlstreambufferUpgrade javassist-javadocUpgrade pki-caUpgrade jackson-jaxrs-json-provider | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsource | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub