Reflected Cross-Site Scripting in Apache CXF

Description

Affected products

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Advisories 8

• RHSA-2020:2513 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
• RHSA-2020:2512 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
• RHSA-2020:2511 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
• WID-SEC-2025-2123 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
• RHSA-2020:2059 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
• RHSA-2020:2060 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
• RHSA-2020:2058 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
• WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026

References

• [announce] 20200116 [CVE-2019-17573] Apache CXF Reflected XSS in the services listing page mailing-list
• [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
• [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html mailing-list
• https://www.oracle.com/security-alerts/cpujul2020.html
• http://cxf.apache.org/security-advisories.data/CVE-2019-17573.txt.asc?version=1&modificationDate=1579178542000&api=v2
• [cxf-dev] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath mailing-list
• [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html mailing-list
• [cxf-users] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath mailing-list
• [oss-security] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath mailing-list
• [announce] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath mailing-list
• [cxf-users] 20201125 RE: CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath mailing-list
• [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html mailing-list
• https://www.oracle.com/security-alerts/cpuApr2021.html
• [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html mailing-list