A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade stax-exUpgrade bea-stax-apiUpgrade velocityUpgrade jackson-coreUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade pki-servlet-engineUpgrade python3-nssUpgrade xml-commons-apisUpgrade jakarta-commons-httpclientUpgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade xerces-j2Upgrade xmlstreambufferUpgrade apache-commons-netUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade jackson-databindUpgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade resteasyUpgrade xalan-j2Upgrade glassfish-jaxb-runtimeUpgrade jackson-annotationsUpgrade xsomUpgrade javassistUpgrade glassfish-fastinfoset | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-serverUpgrade pki-caUpgrade pki-kraUpgrade pki-javadocUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade pki-symkey | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade python3-nssUpgrade ldapjdkUpgrade tomcatjssUpgrade javassist-javadocUpgrade jss-javadocUpgrade xml-commons-apisUpgrade bea-stax-apiUpgrade xml-commons-resolverUpgrade apache-commons-netUpgrade pki-core-debuginfoUpgrade xalan-j2Upgrade python3-pkiUpgrade jackson-jaxrs-json-providerUpgrade resteasyUpgrade pki-servlet-4.0-apiUpgrade pki-base-javaUpgrade pki-caUpgrade glassfish-jaxb-coreUpgrade pki-core-debugsourceUpgrade pki-tools-debuginfoUpgrade jackson-coreUpgrade jackson-databindUpgrade pki-baseUpgrade apache-commons-langUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade jssUpgrade pki-kraUpgrade pki-serverUpgrade jackson-jaxrs-providersUpgrade xsomUpgrade python-nss-docUpgrade pki-javadocUpgrade javassistUpgrade slf4jUpgrade stax-exUpgrade python3-nss-debuginfoUpgrade pki-symkeyUpgrade slf4j-jdk14Upgrade relaxngDatatypeUpgrade velocityUpgrade jss-debuginfoUpgrade pki-servlet-engineUpgrade ldapjdk-javadocUpgrade jackson-annotationsUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade pki-toolsUpgrade jss-debugsourceUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-apiUpgrade pki-symkey-debuginfo | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-symkeyUpgrade pki-caUpgrade pki-toolsUpgrade pki-kraUpgrade pki-baseUpgrade pki-server | Sep 16, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-serverUpgrade pki-toolsUpgrade pki-caUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-base | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-baseUpgrade pki-caUpgrade pki-kraUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-base-java | Mar 24, 2021 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade python3-pkiUpgrade xmlstreambufferUpgrade pki-baseUpgrade relaxngDatatypeUpgrade apache-commons-langUpgrade slf4jUpgrade jss-javadocUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade ldapjdkUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade pki-kraUpgrade jakarta-commons-httpclientUpgrade javassist-javadocUpgrade tomcatjssUpgrade ldapjdk-javadocUpgrade apache-commons-netUpgrade xerces-j2Upgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade velocityUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade jackson-annotationsUpgrade javassistUpgrade bea-stax-apiUpgrade pki-javadocUpgrade glassfish-jaxb-apiUpgrade pki-serverUpgrade glassfish-jaxb-txw2Upgrade resteasyUpgrade pki-base-javaUpgrade xml-commons-resolverUpgrade stax-exUpgrade pki-servlet-4.0-apiUpgrade jssUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade slf4j-jdk14Upgrade xsomUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-caUpgrade python3-nssUpgrade jackson-jaxrs-providers | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade jss-debuginfoUpgrade javassistUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade pki-toolsUpgrade slf4j-jdk14Upgrade ldapjdk-javadocUpgrade pki-servlet-engineUpgrade slf4jUpgrade pki-serverUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade jss-debugsourceUpgrade jssUpgrade python-nss-debugsourceUpgrade pki-symkey-debuginfoUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade pki-kraUpgrade pki-javadocUpgrade jakarta-commons-httpclientUpgrade relaxngDatatypeUpgrade pki-core-debugsourceUpgrade python3-nss-debuginfoUpgrade xsomUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade glassfish-jaxb-coreNo solution existsUpgrade pki-base-javaUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade pki-servlet-4.0-apiUpgrade bea-stax-apiUpgrade python3-pkiUpgrade apache-commons-netUpgrade ldapjdkUpgrade apache-commons-langUpgrade jackson-databindUpgrade resteasyUpgrade tomcatjssUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade glassfish-fastinfosetUpgrade pki-caUpgrade glassfish-jaxb-runtimeUpgrade pki-baseUpgrade pki-symkeyUpgrade xerces-j2Upgrade jackson-coreUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-txw2Upgrade python-nss-docUpgrade pki-core-debuginfoUpgrade jss-javadocUpgrade python3-nss | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nssUpgrade python-nss-docUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub