Cross-site scripting in Apache CXF
Priority LOW 37CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 14 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.
Why it matters now
EPSS 0.07055 94th percentileScored 2026-11-07
Fix Partial org.apache.cxf:apache-cxf (Maven): 3.2.12, 3.3.5org.apache.cxf:cxf (Maven): 3.2.12, 3.3.5Red Hat: 14 advisoriesRed Hat: 14 fixed, 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | CXF | All versions of Apache CXF prior to 3.3.5 and 3.2.12. | — | No fix listed | CNA |
| — | org.apache.cxf:apache-cxf (Maven) | before 3.2.12 | 3.2.12 | Patch available | GHSA-f93p-f762-vr53 |
| — | org.apache.cxf:apache-cxf (Maven) | 3.3.0 to before 3.3.5 | 3.3.5 | Patch available | GHSA-f93p-f762-vr53 |
| — | org.apache.cxf:cxf (Maven) | before 3.2.12 | 3.2.12 | Patch available | GHSA-f93p-f762-vr53 |
| — | org.apache.cxf:cxf (Maven) | 3.3.0 to before 3.3.5 | 3.3.5 | Patch available | GHSA-f93p-f762-vr53 |
- CXF VendorApache Affected All versions of Apache CXF prior to 3.3.5 and 3.2.12. Fixed in — No fix listed CNA
- org.apache.cxf:apache-cxf (Maven) Vendor— Affected before 3.2.12 Fixed in 3.2.12 Patch available GHSA-f93p-f762-vr53
- org.apache.cxf:apache-cxf (Maven) Vendor— Affected 3.3.0 to before 3.3.5 Fixed in 3.3.5 Patch available GHSA-f93p-f762-vr53
- org.apache.cxf:cxf (Maven) Vendor— Affected before 3.2.12 Fixed in 3.2.12 Patch available GHSA-f93p-f762-vr53
- org.apache.cxf:cxf (Maven) Vendor— Affected 3.3.0 to before 3.3.5 Fixed in 3.3.5 Patch available GHSA-f93p-f762-vr53
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* | 3.2.0 – 3.2.12; 3.3.0 to before 3.3.5 | Vulnerable | Apache |
| cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* | 11.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* | 8.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* | 8.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* | 8.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* | 8.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* | 8.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* | 8.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* | 8.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* | 8.2.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* Versions 3.2.0 – 3.2.12; 3.3.0 to before 3.3.5 Vulnerable ·Apache
- cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* Versions 8.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* Versions 8.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·Oracle
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* | 8.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* | 12.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* Versions 8.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-f93p-f762-vr53 org.apache.cxf:apache-cxf (Maven) Fixed in 3.2.12 Advisory →
- Fix · GHSA-f93p-f762-vr53 org.apache.cxf:apache-cxf (Maven) Fixed in 3.3.5 Advisory →
- Fix · GHSA-f93p-f762-vr53 org.apache.cxf:cxf (Maven) Fixed in 3.2.12 Advisory →
- Fix · GHSA-f93p-f762-vr53 org.apache.cxf:cxf (Maven) Fixed in 3.3.5 Advisory →
Red Hat 14 advisories
- RHSA-2020:3197 Released 2020-07-29 · Red Hat rating ImportantRed Hat Process Automation Manager 7.8.0 Security Update
- Red Hat Process Automation 7
- RHSA-2020:3196 Released 2020-07-29 · Red Hat rating ImportantRed Hat Decision Manager 7.8.0 Security Update
- Red Hat Decision Manager 7
- RHSA-2020:3192 Released 2020-07-28 · Red Hat rating ImportantRed Hat Fuse 7.7.0 release and security update
- Red Hat Fuse 7.7.0
Show 11 more Red Hat advisories
- RHSA-2020:2905 Released 2020-07-23 · Red Hat rating ImportantRed Hat build of Thorntail 2.7.0 security and bug fix update
- Text-Only RHOAR
- RHSA-2020:2511 Released 2020-06-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47
- RHSA-2020:2512 Released 2020-06-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
- RHSA-2020:2513 Released 2020-06-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
- RHSA-2020:2515 Released 2020-06-10 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss Enterprise Application Platform 7
- RHSA-2020:2333 Released 2020-05-28 · Red Hat rating ImportantEAP Continuous Delivery Technical Preview Release 19 security update
- EAP-CD 19 Tech Preview
- RHSA-2020:2112 Released 2020-05-12 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.8 security update
- Red Hat Single Sign On 7.3.8
- RHSA-2020:2061 Released 2020-05-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.8 security update
- Red Hat JBoss EAP 7.2
- RHSA-2020:2060 Released 2020-05-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
- RHSA-2020:2059 Released 2020-05-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
- RHSA-2020:2058 Released 2020-05-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat support for Spring Boot | Affected | No fix planned: Will not fix |
| EAP-CD 19 Tech Preview | Fixed | RHSA-2020:2333 |
| Red Hat Decision Manager 7 | Fixed | RHSA-2020:3196 |
| Red Hat Fuse 7.7.0 | Fixed | RHSA-2020:3192 |
| Red Hat JBoss EAP 7.2 | Fixed | RHSA-2020:2061 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2020:2058 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2020:2059 |
| Red Hat JBoss EAP 7.2 for RHEL 8 | Fixed | RHSA-2020:2060 |
| Red Hat JBoss EAP 7.3 for BaseOS-8 | Fixed | RHSA-2020:2513 |
| Red Hat JBoss EAP 7.3 for RHEL 6 Server | Fixed | RHSA-2020:2511 |
| Red Hat JBoss EAP 7.3 for RHEL 7 Server | Fixed | RHSA-2020:2512 |
| Red Hat JBoss Enterprise Application Platform 7 | Fixed | RHSA-2020:2515 |
| Red Hat Process Automation 7 | Fixed | RHSA-2020:3197 |
| Red Hat Single Sign On 7.3.8 | Fixed | RHSA-2020:2112 |
| Text-Only RHOAR | Fixed | RHSA-2020:2905 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-17573
- 2026-10-03 Alias added: GHSA-f93p-f762-vr53
- 2026-11-05 Fix available: Red Hat JBoss Enterprise Application Platform 7 · Red Hat
References
Patch 2
Advisory 3
Other 21
- [announce] 20200116 [CVE-2019-17573] Apache CXF Reflected XSS in the services listing page
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html
- [cxf-dev] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html
- [cxf-users] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath
- [announce] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath
- [cxf-users] 20201125 RE: CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html
- https://github.com/apache/cxf/commit/a02e96ba1095596bef481919f16a90c5e80a92c8
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r51fdd73548290b2dfd0b48f7ab69bf9ae064dd100364cd8a15f0b3ec@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r51fdd73548290b2dfd0b48f7ab69bf9ae064dd100364cd8a15f0b3ec@%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r51fdd73548290b2dfd0b48f7ab69bf9ae064dd100364cd8a15f0b3ec@%3Cusers.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r81a41a2915985d49bc3ea57dde2018b03584a863878a8532a89f993f@%3Cusers.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rf3b50583fefce2810cbd37c3d358cbcd9a03e750005950bf54546194@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
More Apache Cxf vulnerabilities
- TI-2019-09264 Incorrect authorization in Apache CXF CVSS 3.1CRITICAL 9.8
- TI-2020-10930 Apache CXF Reflected XSS in the services listing page via the styleSheetPath CVSS 3.1MEDIUM 6.1
- TI-2010-01990 Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in… CVSS 3.1CRITICAL 9.8
- TI-2022-22907 Apache CXF SSRF Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-47481 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage CVSS 3.1CRITICAL 9.8
- TI-2025-31053 Apache CXF: Untrusted JMS configuration can lead to RCE CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-17573 · CVE Program
- CVE-2019-17573 · NVD
- FIRST EPSS
- GHSA-f93p-f762-vr53 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-17573 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences