A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xmlstreambufferUpgrade javassist-javadocUpgrade resteasyUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade pki-servlet-4.0-apiUpgrade apache-commons-netUpgrade xalan-j2Upgrade xml-commons-resolverUpgrade xerces-j2Upgrade apache-commons-langUpgrade jackson-annotationsUpgrade jackson-databindUpgrade slf4jUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade javassistUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade pki-servlet-engineUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade xml-commons-apisUpgrade velocityUpgrade stax-exUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade jackson-core | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-serverUpgrade pki-caUpgrade pki-kraUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-javadoc | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade javassistUpgrade pki-javadocUpgrade python3-nss-debuginfoUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-debugsourceUpgrade apache-commons-collectionsUpgrade jackson-jaxrs-providersUpgrade jssUpgrade slf4jUpgrade glassfish-jaxb-apiUpgrade stax-exUpgrade jackson-annotationsUpgrade jss-debuginfoUpgrade glassfish-fastinfosetUpgrade pki-servlet-engineUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade xsomUpgrade jss-debugsourceUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-toolsUpgrade slf4j-jdk14Upgrade pki-symkey-debuginfoUpgrade relaxngDatatypeUpgrade ldapjdk-javadocUpgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade pki-core-debugsourceUpgrade pki-caUpgrade xmlstreambufferUpgrade apache-commons-netUpgrade python3-nssUpgrade pki-servlet-4.0-apiUpgrade tomcatjssUpgrade resteasyUpgrade jss-javadocUpgrade glassfish-jaxb-txw2Upgrade bea-stax-apiUpgrade jackson-coreUpgrade xerces-j2Upgrade apache-commons-langUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debuginfoUpgrade pki-tools-debuginfoUpgrade pki-baseUpgrade python3-pkiUpgrade pki-base-javaUpgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade ldapjdk | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-caUpgrade pki-serverUpgrade pki-kraUpgrade pki-toolsUpgrade pki-symkey | Sep 16, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-caUpgrade pki-serverUpgrade pki-kraUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-base | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-symkeyUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-toolsUpgrade pki-baseUpgrade pki-kraUpgrade pki-ca | Mar 24, 2021 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade apache-commons-collectionsUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade python3-nssUpgrade pki-toolsUpgrade xsomUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade pki-symkeyUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade xml-commons-resolverUpgrade jssUpgrade pki-baseUpgrade tomcatjssUpgrade ldapjdk-javadocUpgrade apache-commons-netUpgrade pki-javadocUpgrade jackson-jaxrs-json-providerUpgrade bea-stax-apiUpgrade velocityUpgrade pki-kraUpgrade glassfish-jaxb-txw2Upgrade jackson-databindUpgrade pki-serverUpgrade resteasyUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade pki-base-javaUpgrade jss-javadocUpgrade python3-pkiUpgrade xmlstreambufferUpgrade ldapjdkUpgrade xalan-j2Upgrade javassist-javadocUpgrade xerces-j2Upgrade xml-commons-apisUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-coreUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade pki-servlet-engineUpgrade glassfish-fastinfoset | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade xmlstreambufferUpgrade jackson-coreUpgrade jss-javadocUpgrade apache-commons-netUpgrade tomcatjssUpgrade pki-caUpgrade python3-nssUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade xerces-j2Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade pki-baseUpgrade bea-stax-apiUpgrade python3-pkiUpgrade pki-base-javaUpgrade pki-core-debugsourceUpgrade javassist-javadocUpgrade ldapjdkUpgrade jackson-jaxrs-json-providerUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverNo solution existsUpgrade python-nss-docUpgrade pki-tools-debuginfoUpgrade apache-commons-langUpgrade xsomUpgrade glassfish-jaxb-txw2Upgrade resteasyUpgrade pki-servlet-4.0-apiUpgrade python3-nss-debuginfoUpgrade jackson-databindUpgrade ldapjdk-javadocUpgrade pki-javadocUpgrade velocityUpgrade xml-commons-apisUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade pki-kraUpgrade stax-exUpgrade slf4jUpgrade relaxngDatatypeUpgrade pki-serverUpgrade slf4j-jdk14Upgrade jss-debuginfoUpgrade pki-toolsUpgrade jackson-annotationsUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade pki-symkey-debuginfoUpgrade jssUpgrade jss-debugsource | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nssUpgrade python-nss-docUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub