A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-fastinfosetUpgrade stax-exUpgrade python-nss-docUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade pki-servlet-engineUpgrade jackson-annotationsUpgrade apache-commons-collectionsUpgrade javassistUpgrade velocityUpgrade slf4j-jdk14Upgrade python3-nssUpgrade glassfish-jaxb-apiUpgrade xerces-j2Upgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade apache-commons-netUpgrade jackson-databindUpgrade bea-stax-apiUpgrade xalan-j2Upgrade xmlstreambufferUpgrade xsomUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-langUpgrade glassfish-jaxb-txw2 | May 4, 2022 | May 28, 2021 |
| Amazon Linux Ami 2 | — | Upgrade pki-symkeyUpgrade pki-toolsUpgrade pki-javadocUpgrade pki-base-javaUpgrade pki-caUpgrade pki-baseUpgrade pki-serverUpgrade pki-kraUpgrade pki-core-debuginfo | Apr 23, 2021 | Apr 23, 2021 |
| Centos_linux | — | Upgrade jss-debuginfoUpgrade ldapjdk-javadocUpgrade pki-symkey-debuginfoUpgrade jakarta-commons-httpclientUpgrade python3-nssUpgrade xsomUpgrade pki-symkeyUpgrade javassist-javadocUpgrade pki-toolsUpgrade pki-servlet-engineUpgrade slf4jUpgrade glassfish-jaxb-coreUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade pki-javadocUpgrade python3-nss-debuginfoUpgrade javassistUpgrade jssUpgrade pki-caUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade jackson-databindUpgrade stax-exUpgrade xml-commons-resolverUpgrade jackson-coreUpgrade tomcatjssUpgrade pki-tools-debuginfoUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-core-debugsourceUpgrade jss-javadocUpgrade glassfish-fastinfosetUpgrade ldapjdkUpgrade pki-servlet-4.0-apiUpgrade pki-kraUpgrade xerces-j2Upgrade python3-pkiUpgrade jss-debugsourceUpgrade bea-stax-apiUpgrade pki-serverUpgrade xmlstreambufferUpgrade resteasyUpgrade velocityUpgrade jackson-jaxrs-providersUpgrade apache-commons-netUpgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade pki-core-debuginfoUpgrade jackson-annotationsUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade jackson-module-jaxb-annotationsUpgrade xalan-j2 | Mar 18, 2021 | Mar 15, 2021 |
| Debian | — | No solution exists | May 15, 2025 | May 28, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-caUpgrade pki-baseUpgrade pki-serverUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-kra | Sep 16, 2021 | May 28, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-serverUpgrade pki-baseUpgrade pki-kraUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-ca | Apr 30, 2021 | Apr 30, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-kraUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-toolsUpgrade pki-caUpgrade pki-base | May 19, 2021 | Apr 30, 2021 |
| Oracle_linux | — | Upgrade pki-javadocUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-caUpgrade pki-toolsUpgrade pki-kraUpgrade pki-server | Mar 18, 2021 | Mar 2, 2021 |
| Redhat_linux | — | Upgrade python3-nss-debuginfoUpgrade relaxngDatatypeUpgrade tomcatjssUpgrade ldapjdk-javadocUpgrade resteasyUpgrade glassfish-fastinfosetUpgrade pki-caUpgrade jss-debugsourceUpgrade javassist-javadocUpgrade jss-javadocUpgrade pki-base-javaUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade pki-serverUpgrade jss-debuginfoUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade pki-core-debuginfoUpgrade python3-pkiUpgrade xsomUpgrade apache-commons-netUpgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade pki-core-debugsourceUpgrade pki-servlet-4.0-apiUpgrade pki-baseUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade pki-tools-debuginfoUpgrade xalan-j2Upgrade pki-symkeyUpgrade pki-symkey-debuginfoUpgrade pki-servlet-engineUpgrade ldapjdkNo solution existsUpgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade jackson-jaxrs-providersUpgrade pki-kraUpgrade python-nss-debugsourceUpgrade slf4jUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade pki-toolsUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade jssUpgrade stax-exUpgrade jackson-annotationsUpgrade pki-javadocUpgrade bea-stax-apiUpgrade apache-commons-langUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade python3-nss | Mar 18, 2021 | Mar 15, 2021 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-doc | Mar 12, 2024 | May 28, 2021 |
| Ubuntu | — | Upgrade pki-ca (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro)Upgrade pki-base-java (Ubuntu Pro)Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro) | Dec 11, 2024 | May 28, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub