Skip to main content

CVE-2019-17573

Severity

6.1

Description

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.

Related links:

Project

Apache TomEE

Category
Cross Site Scripting
Tags
data
Date Disclosed

2020-01-16

Date Discovered

2019-10-14

Apache TomEE 8.0.x

First release:
2019-09-13
CVEs:
88
Support Lifecycle:
Namespace:
javax
8.0.08.0.1

Apache TomEE 7.1.x

First release:
2018-09-02
CVEs:
81
Support Lifecycle:
Namespace:
javax
7.1.07.1.17.1.27.1.37.1.4

Apache TomEE 7.0.x

First release:
2016-05-17
CVEs:
111
Support Lifecycle:
Namespace:
javax
7.0.07.0.17.0.27.0.37.0.47.0.57.0.67.0.77.0.87.0.9

Apache TomEE 1.7.x

First release:
2014-08-09
CVEs:
95
Support Lifecycle:
Namespace:
javax
1.7.01.7.11.7.21.7.31.7.41.7.5

Apache TomEE 1.6.x

First release:
2013-11-17
CVEs:
108
Support Lifecycle:
Namespace:
javax
1.6.01.6.0.11.6.0.2

Apache TomEE 1.5.x

First release:
2012-09-28
CVEs:
119
Support Lifecycle:
Namespace:
javax
1.5.01.5.11.5.2

Apache TomEE 1.0.x

First release:
2012-04-27
CVEs:
130
Support Lifecycle:
Namespace:
javax
1.0.0
Feel Vulnerable? 

Contact us so we can help you.

* These fields are required.