On 2020/11/12 12:36:35 Colm O hEigeartaigh wrote:
> Description:
>
> By default, Apache CXF creates a /services page containing a listing of
the
> available endpoint names and addresses. This webpage is vulnerable to a
> reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which
> allows a malicious actor to inject javascript into the web page.
>
> This vulnerability affects all versions of Apache CXF prior to 3.4.1 and
> 3.3.8.
>
> Please note that this is a separate issue to CVE-2019-17573.
>
> Workaround:
>
> Users of Apache CXF should update to either 3.3.8 or 3.4.1. Alternatively,
> it is possible to disable the service listing altogether by setting the
> "hide-service-list-page" servlet parameter to "true".
>
> Credit:
>
> Thanks to Ryan Lambeth for reporting this issue.
>
> References: http://cxf.apache.org/security-advisories.html
>
Carlos A sanchez$$$+1
