Not rated
CVE-2020-13954 By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses
Description
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache CXF 3.4 | earliest → < 3.4.1 | 3.4.1 |
| Apache CXF 3.3 | earliest → < 3.3.8 | 3.3.8 |
References
- cxf.apache.org cxf.apache.org
- [cxf-dev] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath lists.apache.org
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html lists.apache.org
- [cxf-users] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath lists.apache.org
- [oss-security] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath www.openwall.com
- [announce] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath lists.apache.org
- [cxf-users] 20201125 RE: CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath lists.apache.org
- www.oracle.com www.oracle.com
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html lists.apache.org
- [syncope-dev] 20210526 [GitHub] [syncope] coheigea opened a new pull request #268: Disable CXF Services Listing lists.apache.org
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html lists.apache.org
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
Timeline
- Published
- Last modified
Other CVEs of Apache CXF
The 56 CVEs of Apache CXF →
CVE-2026-108039
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML…
Not rated
CVE-2026-107938
In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the…
Not rated
CVE-2026-107937
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured…
Not rated
CVE-2026-100227
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module
Not rated