CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath
Apache CXF is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the services listing page. A remote attacker could exploit this vulnerability using the styleSheetPath in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Other sources
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-13954?
CVE-2020-13954 is a vulnerability in Apache CXF that allows remote attackers to execute script in a victim's web browser through a specially-crafted URL.
What is the severity of CVE-2020-13954?
CVE-2020-13954 has a severity rating of 6.1 (Medium).
How does CVE-2020-13954 affect Apache CXF?
CVE-2020-13954 affects Apache CXF by allowing cross-site scripting attacks through improper validation of user-supplied input on the services listing page.
Which versions of Apache CXF are affected by CVE-2020-13954?
CVE-2020-13954 affects Apache CXF versions up to and including 3.3.8, and versions up to and including 3.4.1.
How do I fix CVE-2020-13954?
To fix CVE-2020-13954, it is recommended to upgrade to Apache CXF version 3.3.9 or 3.4.2 or later.