A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xml-commons-apisUpgrade glassfish-jaxb-apiUpgrade jackson-coreUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade pki-servlet-engineUpgrade stax-exUpgrade python3-nssUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade jackson-jaxrs-providersUpgrade xml-commons-resolverUpgrade jackson-annotationsUpgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-netUpgrade glassfish-jaxb-txw2Upgrade jackson-databindUpgrade xerces-j2Upgrade xmlstreambufferUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade xalan-j2Upgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade apache-commons-langUpgrade javassistUpgrade slf4jUpgrade pki-servlet-4.0-api | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-caUpgrade pki-kraUpgrade pki-serverUpgrade pki-javadocUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade pki-base | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade pki-toolsUpgrade pki-servlet-engineUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade jssUpgrade slf4j-jdk14Upgrade jss-debugsourceUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade apache-commons-collectionsUpgrade pki-symkey-debuginfoUpgrade javassistUpgrade python-nss-docUpgrade pki-javadocUpgrade xsomUpgrade jackson-annotationsUpgrade pki-symkeyUpgrade glassfish-jaxb-apiUpgrade python3-nss-debuginfoUpgrade jss-debuginfoUpgrade glassfish-fastinfosetUpgrade velocityUpgrade pki-kraUpgrade stax-exUpgrade pki-serverUpgrade ldapjdk-javadocUpgrade xml-commons-apisUpgrade xml-commons-resolverUpgrade python3-nssUpgrade pki-baseUpgrade pki-caUpgrade jss-javadocUpgrade python3-pkiUpgrade apache-commons-langUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade ldapjdkUpgrade javassist-javadocUpgrade xmlstreambufferUpgrade xalan-j2Upgrade apache-commons-netUpgrade pki-core-debuginfoUpgrade bea-stax-apiUpgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade pki-base-javaUpgrade jackson-jaxrs-json-providerUpgrade pki-core-debugsourceUpgrade tomcatjssUpgrade jackson-coreUpgrade xerces-j2Upgrade pki-servlet-4.0-apiUpgrade resteasyUpgrade pki-tools-debuginfo | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-baseUpgrade pki-toolsUpgrade pki-caUpgrade pki-symkey | Sep 16, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-toolsUpgrade pki-kraUpgrade pki-caUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-base | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-serverUpgrade pki-caUpgrade pki-baseUpgrade pki-kra | Mar 24, 2021 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade stax-exUpgrade python-nss-docUpgrade jackson-coreUpgrade slf4j-jdk14Upgrade jssUpgrade pki-caUpgrade pki-toolsUpgrade pki-servlet-4.0-apiUpgrade python3-nssUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade xml-commons-resolverUpgrade pki-symkeyUpgrade glassfish-jaxb-coreUpgrade apache-commons-netUpgrade tomcatjssUpgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade pki-serverUpgrade javassistUpgrade python3-pkiUpgrade xmlstreambufferUpgrade pki-baseUpgrade jss-javadocUpgrade relaxngDatatypeUpgrade ldapjdk-javadocUpgrade jackson-jaxrs-json-providerUpgrade bea-stax-apiUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade pki-kraUpgrade pki-servlet-engineUpgrade slf4jUpgrade xml-commons-apisUpgrade glassfish-jaxb-txw2Upgrade ldapjdkUpgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade jackson-annotationsUpgrade pki-base-javaUpgrade jackson-databindUpgrade xalan-j2Upgrade resteasyUpgrade glassfish-jaxb-apiUpgrade pki-javadoc | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade glassfish-jaxb-runtimeUpgrade bea-stax-apiUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade python3-pkiUpgrade glassfish-fastinfosetUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-coreUpgrade jackson-coreUpgrade apache-commons-langUpgrade xsomUpgrade xerces-j2Upgrade python3-nss-debuginfoUpgrade xalan-j2Upgrade pki-baseNo solution existsUpgrade ldapjdkUpgrade apache-commons-collectionsUpgrade pki-symkeyUpgrade pki-base-javaUpgrade javassist-javadocUpgrade pki-core-debuginfoUpgrade pki-core-debugsourceUpgrade apache-commons-netUpgrade jackson-databindUpgrade tomcatjssUpgrade python3-nssUpgrade xmlstreambufferUpgrade resteasyUpgrade jss-javadocUpgrade pki-symkey-debuginfoUpgrade jackson-module-jaxb-annotationsUpgrade slf4j-jdk14Upgrade velocityUpgrade pki-kraUpgrade relaxngDatatypeUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade ldapjdk-javadocUpgrade jssUpgrade stax-exUpgrade pki-servlet-engineUpgrade python-nss-debugsourceUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade jss-debugsourceUpgrade javassistUpgrade pki-toolsUpgrade pki-serverUpgrade pki-javadocUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade jss-debuginfo | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub