Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 16 Jan 2020 14:10:53 +0000
From: Colm O hEigeartaigh <>
Subject: [CVE-2019-17573] Apache CXF Reflected XSS in the services listing page

CVE-2019-17573: Apache CXF Reflected XSS in the services listing page

Severity: Moderate

Vendor: The Apache Software Foundation

Versions Affected:

This vulnerability affects all versions of Apache CXF prior to 3.3.5 and


By default, Apache CXF creates a /services page containing a listing of the
available endpoint names and addresses. This webpage is vulnerable to a
reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor
inject javascript into the web page.

Please note that the attack exploits a feature which is not typically not
present in modern browsers, who remove dot segments before sending the
request. However, Mobile applications may be vulnerable.


Users of Apache CXF should update to either 3.3.5 or 3.2.12. Alternatively,
it is possible to disable the service listing altogether by setting the
"hide-service-list-page" servlet parameter to "true".


We would like to thank the GE cyber security team for reporting this issue.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.