Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 12 Nov 2020 12:37:40 +0000
From: Colm O hEigeartaigh <>
Subject: CVE-2020-13954: Apache CXF Reflected XSS in the services listing page
 via the styleSheetPath


By default, Apache CXF creates a /services page containing a listing of the
available endpoint names and addresses. This webpage is vulnerable to a
reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which
allows a malicious actor to inject javascript into the web page.

This vulnerability affects all versions of Apache CXF prior to 3.4.1 and

Please note that this is a separate issue to CVE-2019-17573.


Users of Apache CXF should update to either 3.3.8 or 3.4.1. Alternatively,
it is possible to disable the service listing altogether by setting the
"hide-service-list-page" servlet parameter to "true".


Thanks to Ryan Lambeth for reporting this issue.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.