A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade slf4j-jdk14Upgrade xerces-j2Upgrade xml-commons-resolverUpgrade bea-stax-apiUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade stax-exUpgrade xmlstreambufferUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade glassfish-jaxb-runtimeUpgrade velocityUpgrade apache-commons-collectionsUpgrade jackson-databindUpgrade glassfish-jaxb-apiUpgrade python3-nssUpgrade resteasyUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade xsomUpgrade pki-servlet-4.0-apiUpgrade xalan-j2Upgrade jackson-jaxrs-providersUpgrade apache-commons-netUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade pki-servlet-engineUpgrade jackson-annotations | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-base-javaUpgrade pki-kraUpgrade pki-javadocUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade pki-toolsUpgrade pki-ca | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade pki-kraUpgrade pki-symkey-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade pki-javadocUpgrade xml-commons-apisUpgrade pki-symkeyUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade jackson-databindUpgrade stax-exUpgrade python-nss-docUpgrade pki-tools-debuginfoUpgrade xerces-j2Upgrade ldapjdkUpgrade jssUpgrade pki-servlet-engineUpgrade jackson-coreUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade velocityUpgrade jss-debuginfoUpgrade xml-commons-resolverUpgrade jackson-annotationsUpgrade pki-caUpgrade javassistUpgrade ldapjdk-javadocUpgrade pki-servlet-4.0-apiUpgrade apache-commons-netUpgrade tomcatjssUpgrade glassfish-fastinfosetUpgrade pki-serverUpgrade glassfish-jaxb-runtimeUpgrade jackson-module-jaxb-annotationsUpgrade python3-nss-debuginfoUpgrade pki-baseUpgrade slf4jUpgrade jss-debugsourceUpgrade python3-pkiUpgrade xalan-j2Upgrade apache-commons-langUpgrade pki-core-debugsourceUpgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade xsomUpgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade pki-core-debuginfoUpgrade pki-base-javaUpgrade resteasyUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade jss-javadocUpgrade pki-tools | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-symkeyUpgrade pki-caUpgrade pki-kraUpgrade pki-baseUpgrade pki-serverUpgrade pki-tools | Feb 22, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-baseUpgrade pki-symkeyUpgrade pki-caUpgrade pki-base-javaUpgrade pki-toolsUpgrade pki-serverUpgrade pki-kra | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-base-javaUpgrade pki-baseUpgrade pki-kraUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-caUpgrade pki-tools | Dec 16, 2020 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade pki-toolsUpgrade jssUpgrade pki-javadocUpgrade javassistUpgrade apache-commons-langUpgrade resteasyUpgrade xml-commons-apisUpgrade apache-commons-netUpgrade ldapjdk-javadocUpgrade jss-javadocUpgrade pki-base-javaUpgrade tomcatjssUpgrade pki-serverUpgrade pki-caUpgrade pki-kraUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade javassist-javadocUpgrade relaxngDatatypeUpgrade xsomUpgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade xalan-j2Upgrade bea-stax-apiUpgrade ldapjdkUpgrade pki-servlet-engineUpgrade jackson-databindUpgrade python3-nssUpgrade xerces-j2Upgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade velocityUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade stax-exUpgrade apache-commons-collectionsUpgrade xmlstreambufferUpgrade python3-pkiUpgrade jackson-jaxrs-json-providerUpgrade pki-symkeyUpgrade pki-baseUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade xml-commons-resolverUpgrade glassfish-jaxb-api | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade javassist-javadocUpgrade jss-debugsourceUpgrade xerces-j2Upgrade apache-commons-netUpgrade jssUpgrade jackson-coreUpgrade pki-servlet-4.0-apiUpgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade python-nss-debugsourceUpgrade pki-serverUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade jackson-annotationsUpgrade xmlstreambufferUpgrade python3-nss-debuginfoUpgrade xml-commons-apisUpgrade jss-debuginfoUpgrade glassfish-jaxb-txw2Upgrade pki-core-debuginfoUpgrade python-nss-docUpgrade pki-caUpgrade pki-kraUpgrade pki-baseUpgrade xsomUpgrade pki-core-debugsourceUpgrade pki-toolsUpgrade slf4jUpgrade relaxngDatatypeUpgrade pki-symkeyUpgrade python3-pkiUpgrade apache-commons-langUpgrade stax-exUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade resteasyUpgrade tomcatjssUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade pki-tools-debuginfoUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade ldapjdk-javadocUpgrade jss-javadocUpgrade glassfish-jaxb-apiUpgrade pki-symkey-debuginfoUpgrade jackson-jaxrs-providersUpgrade apache-commons-collectionsUpgrade ldapjdkUpgrade pki-javadocUpgrade pki-servlet-engineUpgrade glassfish-jaxb-coreUpgrade pki-base-javaUpgrade velocity | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub