A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade xml-commons-apisUpgrade stax-exUpgrade jackson-databindUpgrade pki-servlet-4.0-apiUpgrade xmlstreambufferUpgrade python3-nssUpgrade resteasyUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade slf4jUpgrade xml-commons-resolverUpgrade velocityUpgrade glassfish-jaxb-runtimeUpgrade jackson-annotationsUpgrade python-nss-docUpgrade slf4j-jdk14Upgrade jackson-jaxrs-json-providerUpgrade xerces-j2Upgrade xsomUpgrade apache-commons-netUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade apache-commons-collectionsUpgrade xalan-j2 | May 4, 2022 | Apr 30, 2021 |
| Amazon Linux Ami 2 | — | Upgrade pki-symkeyUpgrade pki-caUpgrade pki-core-debuginfoUpgrade pki-toolsUpgrade pki-kraUpgrade pki-baseUpgrade pki-base-javaUpgrade pki-javadocUpgrade pki-server | Apr 23, 2021 | Apr 23, 2021 |
| Centos_linux | — | Upgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-apiUpgrade pki-kraUpgrade jss-debuginfoUpgrade slf4j-jdk14Upgrade jssUpgrade pki-servlet-engineUpgrade jackson-coreUpgrade ldapjdkUpgrade xmlstreambufferUpgrade python3-nssUpgrade velocityUpgrade xerces-j2Upgrade bea-stax-apiUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade pki-symkey-debuginfoUpgrade pki-javadocUpgrade pki-tools-debuginfoUpgrade apache-commons-collectionsUpgrade stax-exUpgrade pki-symkeyUpgrade python-nss-docUpgrade xml-commons-apisUpgrade python3-pkiUpgrade javassistUpgrade pki-base-javaUpgrade pki-toolsUpgrade pki-baseUpgrade slf4jUpgrade pki-core-debuginfoUpgrade pki-caUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade xsomUpgrade tomcatjssUpgrade relaxngDatatypeUpgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade resteasyUpgrade glassfish-jaxb-txw2Upgrade pki-serverUpgrade apache-commons-langUpgrade python3-nss-debuginfoUpgrade jakarta-commons-httpclientUpgrade ldapjdk-javadocUpgrade jackson-annotationsUpgrade python-nss-debugsourceUpgrade jss-javadocUpgrade jss-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-netUpgrade xalan-j2Upgrade pki-core-debugsource | Nov 5, 2020 | Nov 3, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Apr 30, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-toolsUpgrade pki-caUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-base | Feb 22, 2021 | Oct 30, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-kraUpgrade pki-serverUpgrade pki-baseUpgrade pki-base-javaUpgrade pki-caUpgrade pki-toolsUpgrade pki-symkey | Apr 30, 2021 | Oct 30, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-kraUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-ca | Nov 2, 2020 | Oct 30, 2020 |
| Oracle_linux | — | Upgrade apache-commons-netUpgrade jssUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-providersUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade pki-caUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade jackson-jaxrs-json-providerUpgrade pki-toolsUpgrade python3-nssUpgrade pki-baseUpgrade slf4jUpgrade python-nss-docUpgrade tomcatjssUpgrade bea-stax-apiUpgrade velocityUpgrade pki-javadocUpgrade pki-base-javaUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade resteasyUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade xml-commons-apisUpgrade xalan-j2Upgrade xmlstreambufferUpgrade stax-exUpgrade pki-servlet-engineUpgrade pki-serverUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade jss-javadocUpgrade python3-pkiUpgrade ldapjdkUpgrade jackson-module-jaxb-annotationsUpgrade xerces-j2Upgrade relaxngDatatypeUpgrade javassist-javadoc | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade stax-exUpgrade pki-base-javaUpgrade jackson-jaxrs-providersUpgrade pki-kraUpgrade glassfish-jaxb-runtimeUpgrade glassfish-fastinfosetUpgrade xsomUpgrade jss-debugsourceUpgrade tomcatjssUpgrade jackson-databindUpgrade python-nss-debugsourceUpgrade jackson-coreUpgrade pki-serverUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade jss-javadocUpgrade python3-nss-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade pki-symkey-debuginfoUpgrade pki-javadocUpgrade xerces-j2Upgrade ldapjdkUpgrade python3-pkiUpgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade relaxngDatatypeUpgrade xalan-j2Upgrade pki-toolsUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade resteasyUpgrade slf4jUpgrade jssUpgrade ldapjdk-javadocUpgrade velocityUpgrade pki-servlet-engineUpgrade apache-commons-netUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade pki-tools-debuginfoUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade bea-stax-apiUpgrade glassfish-jaxb-coreUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade pki-baseUpgrade pki-servlet-4.0-apiUpgrade javassistUpgrade pki-symkeyUpgrade pki-caUpgrade pki-core-debuginfoUpgrade pki-core-debugsourceUpgrade jss-debuginfoUpgrade javassist-javadoc | Nov 5, 2020 | Nov 3, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | Apr 30, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 30, 2021 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub