Tracker / CVE-2019-17573
CVE-2019-17573
Medium 6.1
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.
Affected products and versions
| apache | cxf · 3.2.0 → 3.2.12 |
|---|---|
| apache | cxf · 3.3.0 → 3.3.5 |
| oracle | commerce_guided_search |
| oracle | communications_element_manager |
| oracle | communications_session_report_manager |
| oracle | communications_session_route_manager |
| oracle | flexcube_private_banking |
| oracle | retail_order_broker |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.