A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade python-nss-docUpgrade pki-servlet-engineUpgrade glassfish-jaxb-coreUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade javassistUpgrade stax-exUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade python3-nssUpgrade jackson-annotationsUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade apache-commons-netUpgrade xalan-j2Upgrade xml-commons-apisUpgrade xsomUpgrade jackson-coreUpgrade xml-commons-resolverUpgrade resteasyUpgrade pki-servlet-4.0-apiUpgrade bea-stax-apiUpgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade jackson-databind | May 4, 2022 | May 28, 2021 |
| Amazon Linux Ami 2 | — | Upgrade pki-serverUpgrade pki-baseUpgrade pki-kraUpgrade pki-core-debuginfoUpgrade pki-caUpgrade pki-javadocUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-base-java | Apr 23, 2021 | Apr 23, 2021 |
| Centos_linux | — | Upgrade javassistUpgrade pki-caUpgrade slf4jUpgrade python-nss-debugsourceUpgrade pki-javadocUpgrade jakarta-commons-httpclientUpgrade jssUpgrade python-nss-docUpgrade xsomUpgrade pki-symkey-debuginfoUpgrade python3-nssUpgrade jss-debuginfoUpgrade apache-commons-collectionsUpgrade pki-servlet-engineUpgrade ldapjdk-javadocUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade pki-toolsUpgrade pki-symkeyUpgrade python3-nss-debuginfoUpgrade jackson-annotationsUpgrade python3-pkiUpgrade pki-servlet-4.0-apiUpgrade jss-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade apache-commons-netUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade pki-serverUpgrade xml-commons-resolverUpgrade jackson-coreUpgrade stax-exUpgrade bea-stax-apiUpgrade xerces-j2Upgrade pki-kraUpgrade ldapjdkUpgrade jss-javadocUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade velocityUpgrade tomcatjssUpgrade pki-tools-debuginfoUpgrade pki-base-javaUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade jackson-databindUpgrade resteasyUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade pki-core-debuginfo | Mar 18, 2021 | Mar 15, 2021 |
| Debian | — | No solution exists | May 15, 2025 | May 28, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-baseUpgrade pki-toolsUpgrade pki-caUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-kra | Sep 16, 2021 | May 28, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-symkeyUpgrade pki-toolsUpgrade pki-caUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-baseUpgrade pki-kra | Apr 30, 2021 | Apr 30, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-kraUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-toolsUpgrade pki-caUpgrade pki-serverUpgrade pki-symkey | May 19, 2021 | Apr 30, 2021 |
| Oracle_linux | — | Upgrade pki-caUpgrade pki-kraUpgrade pki-serverUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-javadoc | Mar 18, 2021 | Mar 2, 2021 |
| Redhat_linux | — | Upgrade slf4j-jdk14Upgrade pki-toolsUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersUpgrade jssUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade python-nss-debugsourceUpgrade pki-symkey-debuginfoUpgrade jackson-annotationsUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade python-nss-docUpgrade slf4jUpgrade python3-nssUpgrade bea-stax-apiUpgrade pki-kraUpgrade apache-commons-langUpgrade pki-javadocUpgrade jackson-databindNo solution existsUpgrade ldapjdkUpgrade xml-commons-apisUpgrade stax-exUpgrade pki-core-debuginfoUpgrade tomcatjssUpgrade xerces-j2Upgrade pki-core-debugsourceUpgrade jss-debugsourceUpgrade glassfish-jaxb-txw2Upgrade pki-baseUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade apache-commons-collectionsUpgrade pki-caUpgrade xmlstreambufferUpgrade javassist-javadocUpgrade resteasyUpgrade xsomUpgrade ldapjdk-javadocUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-serverUpgrade apache-commons-netUpgrade jss-debuginfoUpgrade xml-commons-resolverUpgrade glassfish-fastinfosetUpgrade jss-javadocUpgrade relaxngDatatypeUpgrade jakarta-commons-httpclientUpgrade python3-nss-debuginfoUpgrade xalan-j2Upgrade pki-tools-debuginfoUpgrade python3-pkiUpgrade pki-servlet-4.0-api | Mar 18, 2021 | Mar 15, 2021 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-doc | Mar 12, 2024 | May 28, 2021 |
| Ubuntu | — | Upgrade pki-ca (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro)Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-base-java (Ubuntu Pro) | Dec 11, 2024 | May 28, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub