A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade javassist-javadocUpgrade jackson-annotationsUpgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade javassistUpgrade xsomUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade apache-commons-langUpgrade jackson-jaxrs-json-providerUpgrade slf4jUpgrade apache-commons-collectionsUpgrade resteasyUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade xmlstreambufferUpgrade apache-commons-netUpgrade pki-servlet-4.0-apiUpgrade xerces-j2Upgrade bea-stax-apiUpgrade pki-servlet-engineUpgrade xml-commons-apisUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade velocityUpgrade python3-nssUpgrade jakarta-commons-httpclientUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade python-nss-doc | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-caUpgrade pki-kraUpgrade pki-serverUpgrade pki-javadocUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-toolsUpgrade pki-base-java | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade jackson-annotationsUpgrade jss-debugsourceUpgrade glassfish-fastinfosetUpgrade relaxngDatatypeUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-javadocUpgrade jss-debuginfoUpgrade slf4jUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade pki-toolsUpgrade jssUpgrade jackson-jaxrs-providersUpgrade pki-kraUpgrade python-nss-docUpgrade javassistUpgrade python3-nss-debuginfoUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade pki-servlet-engineUpgrade python-nss-debugsourceUpgrade pki-symkey-debuginfoUpgrade velocityUpgrade xsomUpgrade pki-baseUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-coreUpgrade pki-caUpgrade pki-base-javaUpgrade apache-commons-langUpgrade pki-core-debugsourceUpgrade xml-commons-apisUpgrade jackson-databindUpgrade xerces-j2Upgrade resteasyUpgrade jackson-coreUpgrade python3-nssUpgrade glassfish-jaxb-txw2Upgrade tomcatjssUpgrade bea-stax-apiUpgrade ldapjdkUpgrade apache-commons-netUpgrade xml-commons-resolverUpgrade jss-javadocUpgrade javassist-javadocUpgrade pki-tools-debuginfoUpgrade xalan-j2Upgrade python3-pkiUpgrade pki-core-debuginfoUpgrade pki-servlet-4.0-api | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-ca | Sep 16, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-caUpgrade pki-toolsUpgrade pki-baseUpgrade pki-base-javaUpgrade pki-symkey | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-baseUpgrade pki-caUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-server | Mar 24, 2021 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade apache-commons-langUpgrade pki-serverUpgrade xml-commons-apisUpgrade resteasyUpgrade glassfish-jaxb-coreUpgrade jackson-annotationsUpgrade ldapjdkUpgrade pki-servlet-engineUpgrade jackson-databindUpgrade glassfish-jaxb-apiUpgrade pki-kraUpgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade glassfish-fastinfosetUpgrade pki-base-javaUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade ldapjdk-javadocUpgrade javassist-javadocUpgrade pki-javadocUpgrade apache-commons-netUpgrade xalan-j2Upgrade slf4jUpgrade xerces-j2Upgrade tomcatjssUpgrade python3-pkiUpgrade xmlstreambufferUpgrade relaxngDatatypeUpgrade velocityUpgrade pki-baseUpgrade jss-javadocUpgrade javassistUpgrade pki-symkeyUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade jackson-coreUpgrade python-nss-docUpgrade pki-toolsUpgrade apache-commons-collectionsUpgrade xsomUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade jssUpgrade python3-nss | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade resteasyUpgrade jss-javadocUpgrade jackson-databindUpgrade glassfish-fastinfosetUpgrade tomcatjssUpgrade pki-servlet-4.0-apiUpgrade pki-tools-debuginfoUpgrade ldapjdkUpgrade python3-pkiUpgrade python3-nss-debuginfoUpgrade xsomUpgrade pki-baseUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debugsourceUpgrade pki-base-javaUpgrade bea-stax-apiUpgrade python3-nssUpgrade jackson-coreNo solution existsUpgrade apache-commons-collectionsUpgrade xalan-j2Upgrade javassist-javadocUpgrade xml-commons-resolverUpgrade pki-caUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade apache-commons-netUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade pki-servlet-engineUpgrade xml-commons-apisUpgrade pki-toolsUpgrade jssUpgrade ldapjdk-javadocUpgrade relaxngDatatypeUpgrade slf4j-jdk14Upgrade jackson-module-jaxb-annotationsUpgrade jss-debuginfoUpgrade javassistUpgrade jackson-jaxrs-providersUpgrade jackson-annotationsUpgrade pki-javadocUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade python-nss-debugsourceUpgrade slf4jUpgrade stax-exUpgrade pki-kraUpgrade pki-serverUpgrade velocityUpgrade jss-debugsourceUpgrade pki-symkey-debuginfo | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nssUpgrade python-nss-docUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub