A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade xmlstreambufferUpgrade resteasyUpgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade glassfish-jaxb-runtimeUpgrade glassfish-fastinfosetUpgrade xerces-j2Upgrade javassist-javadocUpgrade xalan-j2Upgrade jackson-annotationsUpgrade apache-commons-netUpgrade xsomUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade python-nss-docUpgrade jackson-coreUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade pki-servlet-engineUpgrade stax-exUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade glassfish-jaxb-api | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-caUpgrade pki-serverUpgrade pki-kraUpgrade pki-core-debuginfoUpgrade pki-toolsUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-javadoc | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade glassfish-fastinfosetUpgrade python3-nss-debuginfoUpgrade jssUpgrade pki-toolsUpgrade javassistUpgrade pki-javadocUpgrade pki-symkeyUpgrade xsomUpgrade pki-kraUpgrade python-nss-docUpgrade jackson-annotationsUpgrade velocityUpgrade jss-debuginfoUpgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade stax-exUpgrade jss-debugsourceUpgrade pki-serverUpgrade pki-servlet-engineUpgrade slf4jUpgrade jackson-jaxrs-providersUpgrade ldapjdk-javadocUpgrade pki-symkey-debuginfoUpgrade python-nss-debugsourceUpgrade slf4j-jdk14Upgrade relaxngDatatypeUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade pki-tools-debuginfoUpgrade jackson-coreUpgrade pki-caUpgrade xmlstreambufferUpgrade xml-commons-apisUpgrade xml-commons-resolverUpgrade apache-commons-netUpgrade pki-core-debuginfoUpgrade xalan-j2Upgrade python3-pkiUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade pki-baseUpgrade xerces-j2Upgrade resteasyUpgrade glassfish-jaxb-txw2Upgrade jss-javadocUpgrade javassist-javadocUpgrade bea-stax-apiUpgrade glassfish-jaxb-runtimeUpgrade pki-base-javaUpgrade jackson-databindUpgrade ldapjdkUpgrade pki-servlet-4.0-apiUpgrade tomcatjssUpgrade pki-core-debugsourceUpgrade jackson-jaxrs-json-provider | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-kraUpgrade pki-serverUpgrade pki-caUpgrade pki-symkeyUpgrade pki-tools | Sep 16, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-caUpgrade pki-kraUpgrade pki-toolsUpgrade pki-server | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-toolsUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-caUpgrade pki-kra | Mar 24, 2021 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade pki-servlet-engineUpgrade jackson-annotationsUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade xml-commons-apisUpgrade jss-javadocUpgrade apache-commons-langUpgrade ldapjdk-javadocUpgrade python3-pkiUpgrade xmlstreambufferUpgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade glassfish-fastinfosetUpgrade velocityUpgrade ldapjdkUpgrade javassist-javadocUpgrade apache-commons-netUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade tomcatjssUpgrade pki-baseUpgrade pki-serverUpgrade xalan-j2Upgrade glassfish-jaxb-apiUpgrade javassistUpgrade pki-kraUpgrade glassfish-jaxb-coreUpgrade pki-javadocUpgrade pki-base-javaUpgrade resteasyUpgrade jackson-databindUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade pki-toolsUpgrade python3-nssUpgrade jssUpgrade stax-exUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade jackson-coreUpgrade pki-caUpgrade pki-servlet-4.0-apiUpgrade pki-symkeyUpgrade xsomUpgrade jackson-jaxrs-providers | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade bea-stax-apiUpgrade python3-nss-debuginfoUpgrade pki-baseUpgrade pki-tools-debuginfoUpgrade resteasyUpgrade pki-base-javaUpgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade pki-core-debuginfoUpgrade xalan-j2Upgrade jackson-coreUpgrade jss-javadocUpgrade xmlstreambufferUpgrade python-nss-docUpgrade python3-nssUpgrade pki-caUpgrade glassfish-jaxb-runtimeUpgrade tomcatjssUpgrade apache-commons-netUpgrade pki-core-debugsourceUpgrade xsomNo solution existsUpgrade pki-servlet-4.0-apiUpgrade python3-pkiUpgrade ldapjdkUpgrade glassfish-jaxb-txw2Upgrade xerces-j2Upgrade pki-symkeyUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade jackson-databindUpgrade jakarta-commons-httpclientUpgrade pki-kraUpgrade ldapjdk-javadocUpgrade pki-javadocUpgrade pki-symkey-debuginfoUpgrade jssUpgrade jss-debugsourceUpgrade pki-serverUpgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-engineUpgrade python-nss-debugsourceUpgrade jackson-annotationsUpgrade slf4j-jdk14Upgrade stax-exUpgrade xml-commons-apisUpgrade slf4jUpgrade jackson-jaxrs-providersUpgrade jss-debuginfoUpgrade pki-toolsUpgrade javassistUpgrade velocityUpgrade relaxngDatatypeUpgrade glassfish-jaxb-api | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python3-nssUpgrade python-nss-debugsourceUpgrade python-nss-doc | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub