A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-apache-commons-collectionsalma-upgrade-apache-commons-langalma-upgrade-apache-commons-netalma-upgrade-bea-stax-apialma-upgrade-glassfish-fastinfosetalma-upgrade-glassfish-jaxb-apialma-upgrade-glassfish-jaxb-corealma-upgrade-glassfish-jaxb-runtimealma-upgrade-glassfish-jaxb-txw2alma-upgrade-jackson-annotationsalma-upgrade-jackson-corealma-upgrade-jackson-databindalma-upgrade-jackson-jaxrs-json-provideralma-upgrade-jackson-jaxrs-providersalma-upgrade-jackson-module-jaxb-annotationsalma-upgrade-jakarta-commons-httpclientalma-upgrade-javassistalma-upgrade-javassist-javadocalma-upgrade-pki-servlet-4.0-apialma-upgrade-pki-servlet-enginealma-upgrade-python-nss-docalma-upgrade-python3-nssalma-upgrade-relaxngDatatypealma-upgrade-resteasyalma-upgrade-slf4jalma-upgrade-slf4j-jdk14alma-upgrade-stax-exalma-upgrade-velocityalma-upgrade-xalan-j2alma-upgrade-xerces-j2alma-upgrade-xml-commons-apisalma-upgrade-xml-commons-resolveralma-upgrade-xmlstreambufferalma-upgrade-xsom | May 4, 2022 | May 28, 2021 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-pki-baseamazon-linux-ami-2-upgrade-pki-base-javaamazon-linux-ami-2-upgrade-pki-caamazon-linux-ami-2-upgrade-pki-core-debuginfoamazon-linux-ami-2-upgrade-pki-javadocamazon-linux-ami-2-upgrade-pki-kraamazon-linux-ami-2-upgrade-pki-serveramazon-linux-ami-2-upgrade-pki-symkeyamazon-linux-ami-2-upgrade-pki-tools | Apr 23, 2021 | Apr 23, 2021 | |
| Centos_linux | — | centos-upgrade-apache-commons-collectionscentos-upgrade-apache-commons-langcentos-upgrade-apache-commons-netcentos-upgrade-bea-stax-apicentos-upgrade-glassfish-fastinfosetcentos-upgrade-glassfish-jaxb-apicentos-upgrade-glassfish-jaxb-corecentos-upgrade-glassfish-jaxb-runtimecentos-upgrade-glassfish-jaxb-txw2centos-upgrade-jackson-annotationscentos-upgrade-jackson-corecentos-upgrade-jackson-databindcentos-upgrade-jackson-jaxrs-json-providercentos-upgrade-jackson-jaxrs-providerscentos-upgrade-jackson-module-jaxb-annotationscentos-upgrade-jakarta-commons-httpclientcentos-upgrade-javassistcentos-upgrade-javassist-javadoccentos-upgrade-jsscentos-upgrade-jss-debuginfocentos-upgrade-jss-debugsourcecentos-upgrade-jss-javadoccentos-upgrade-ldapjdkcentos-upgrade-ldapjdk-javadoccentos-upgrade-pki-basecentos-upgrade-pki-base-javacentos-upgrade-pki-cacentos-upgrade-pki-core-debuginfocentos-upgrade-pki-core-debugsourcecentos-upgrade-pki-javadoccentos-upgrade-pki-kracentos-upgrade-pki-servercentos-upgrade-pki-servlet-4-0-apicentos-upgrade-pki-servlet-enginecentos-upgrade-pki-symkeycentos-upgrade-pki-symkey-debuginfocentos-upgrade-pki-toolscentos-upgrade-pki-tools-debuginfocentos-upgrade-python-nss-debugsourcecentos-upgrade-python-nss-doccentos-upgrade-python3-nsscentos-upgrade-python3-nss-debuginfocentos-upgrade-python3-pkicentos-upgrade-relaxngdatatypecentos-upgrade-resteasycentos-upgrade-slf4jcentos-upgrade-slf4j-jdk14centos-upgrade-stax-excentos-upgrade-tomcatjsscentos-upgrade-velocitycentos-upgrade-xalan-j2centos-upgrade-xerces-j2centos-upgrade-xml-commons-apiscentos-upgrade-xml-commons-resolvercentos-upgrade-xmlstreambuffercentos-upgrade-xsom | Mar 18, 2021 | Mar 15, 2021 |
| Debian | no-fix-debian-deb-package | May 15, 2025 | May 28, 2021 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-pki-basehuawei-euleros-2_0_sp2-upgrade-pki-cahuawei-euleros-2_0_sp2-upgrade-pki-krahuawei-euleros-2_0_sp2-upgrade-pki-serverhuawei-euleros-2_0_sp2-upgrade-pki-symkeyhuawei-euleros-2_0_sp2-upgrade-pki-tools | Sep 16, 2021 | May 28, 2021 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-pki-basehuawei-euleros-2_0_sp3-upgrade-pki-base-javahuawei-euleros-2_0_sp3-upgrade-pki-cahuawei-euleros-2_0_sp3-upgrade-pki-krahuawei-euleros-2_0_sp3-upgrade-pki-serverhuawei-euleros-2_0_sp3-upgrade-pki-symkeyhuawei-euleros-2_0_sp3-upgrade-pki-tools | Apr 30, 2021 | Apr 30, 2021 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-pki-basehuawei-euleros-2_0_sp5-upgrade-pki-base-javahuawei-euleros-2_0_sp5-upgrade-pki-cahuawei-euleros-2_0_sp5-upgrade-pki-krahuawei-euleros-2_0_sp5-upgrade-pki-serverhuawei-euleros-2_0_sp5-upgrade-pki-symkeyhuawei-euleros-2_0_sp5-upgrade-pki-tools | May 19, 2021 | Apr 30, 2021 | |
| Oracle_linux | — | oracle-linux-upgrade-pki-baseoracle-linux-upgrade-pki-base-javaoracle-linux-upgrade-pki-caoracle-linux-upgrade-pki-javadocoracle-linux-upgrade-pki-kraoracle-linux-upgrade-pki-serveroracle-linux-upgrade-pki-symkeyoracle-linux-upgrade-pki-tools | Mar 18, 2021 | Mar 2, 2021 |
| Redhat_linux | redhat-upgrade-apache-commons-collectionsredhat-upgrade-apache-commons-langredhat-upgrade-apache-commons-netredhat-upgrade-bea-stax-apiredhat-upgrade-glassfish-fastinfosetredhat-upgrade-glassfish-jaxb-apiredhat-upgrade-glassfish-jaxb-coreredhat-upgrade-glassfish-jaxb-runtimeredhat-upgrade-glassfish-jaxb-txw2redhat-upgrade-jackson-annotationsredhat-upgrade-jackson-coreredhat-upgrade-jackson-databindredhat-upgrade-jackson-jaxrs-json-providerredhat-upgrade-jackson-jaxrs-providersredhat-upgrade-jackson-module-jaxb-annotationsredhat-upgrade-jakarta-commons-httpclientredhat-upgrade-javassistredhat-upgrade-javassist-javadocredhat-upgrade-jssredhat-upgrade-jss-debuginforedhat-upgrade-jss-debugsourceredhat-upgrade-jss-javadocredhat-upgrade-ldapjdkredhat-upgrade-ldapjdk-javadocredhat-upgrade-pki-baseredhat-upgrade-pki-base-javaredhat-upgrade-pki-caredhat-upgrade-pki-core-debuginforedhat-upgrade-pki-core-debugsourceredhat-upgrade-pki-javadocredhat-upgrade-pki-kraredhat-upgrade-pki-serverredhat-upgrade-pki-servlet-4-0-apiredhat-upgrade-pki-servlet-engineredhat-upgrade-pki-symkeyredhat-upgrade-pki-symkey-debuginforedhat-upgrade-pki-toolsredhat-upgrade-pki-tools-debuginforedhat-upgrade-python-nss-debugsourceredhat-upgrade-python-nss-docredhat-upgrade-python3-nssredhat-upgrade-python3-nss-debuginforedhat-upgrade-python3-pkiredhat-upgrade-relaxngdatatyperedhat-upgrade-resteasyredhat-upgrade-slf4jredhat-upgrade-slf4j-jdk14redhat-upgrade-stax-exredhat-upgrade-tomcatjssredhat-upgrade-velocityredhat-upgrade-xalan-j2redhat-upgrade-xerces-j2redhat-upgrade-xml-commons-apisredhat-upgrade-xml-commons-resolverredhat-upgrade-xmlstreambufferredhat-upgrade-xsom | Mar 18, 2021 | Mar 15, 2021 | |
| Rocky_linux | rocky-upgrade-python-nss-debugsourcerocky-upgrade-python-nss-docrocky-upgrade-python3-nssrocky-upgrade-python3-nss-debuginfo | Mar 12, 2024 | May 28, 2021 | |
| Ubuntu | ubuntu-pro-upgrade-dogtag-pkiubuntu-pro-upgrade-pki-baseubuntu-pro-upgrade-pki-base-javaubuntu-pro-upgrade-pki-caubuntu-pro-upgrade-pki-server | Dec 11, 2024 | May 28, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub