[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAB8XdGAqVbPj=oaCN=0_aXNmLLr4NqeAR=r74ogJegEwJqpfWw@mail.gmail.com>
Date: Thu, 16 Jan 2020 14:10:53 +0000
From: Colm O hEigeartaigh <coheigea@...che.org>
To: oss-security@...ts.openwall.com
Subject: [CVE-2019-17573] Apache CXF Reflected XSS in the services listing page
CVE-2019-17573: Apache CXF Reflected XSS in the services listing page
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
This vulnerability affects all versions of Apache CXF prior to 3.3.5 and
3.2.12.
Description:
By default, Apache CXF creates a /services page containing a listing of the
available endpoint names and addresses. This webpage is vulnerable to a
reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor
to
inject javascript into the web page.
Please note that the attack exploits a feature which is not typically not
present in modern browsers, who remove dot segments before sending the
request. However, Mobile applications may be vulnerable.
Mitigation:
Users of Apache CXF should update to either 3.3.5 or 3.2.12. Alternatively,
it is possible to disable the service listing altogether by setting the
"hide-service-list-page" servlet parameter to "true".
Credit:
We would like to thank the GE cyber security team for reporting this issue.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
