cve.bz

CVE-2019-17573

6.1 mediumEPSS 7.1%

Medium (6.1). EPSS 7.1% chance of exploitation in the next 30 days. Fixed in org.apache.cxf:apache-cxf 3.2.12, 3.3.5.

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
7.1% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-f93p-f762-vr53Mavenorg.apache.cxf:apache-cxf<3.2.123.2.12
GHSA-f93p-f762-vr53Mavenorg.apache.cxf:apache-cxf>=3.3.0 <3.3.53.3.5
GHSA-f93p-f762-vr53Mavenorg.apache.cxf:cxf<3.2.123.2.12
GHSA-f93p-f762-vr53Mavenorg.apache.cxf:cxf>=3.3.0 <3.3.53.3.5

References

Check your stackJSON