Not rated
CVE-2023-45757 Security vulnerability in Apache…
Description
Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page. Solution (choose one of three): 1. upgrade to bRPC > 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2411 3. disable rpcz feature
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache bRPC 0.9 | 0.9.0 → 1.6.0 | No fix stated |
References
- lists.apache.org lists.apache.org
- www.openwall.com www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache bRPC
The 41 CVEs of Apache bRPC →
CVE-2026-90484
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a…
Not rated
CVE-2026-87849
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors…
Not rated
CVE-2026-86249
On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption…
Not rated
CVE-2026-86147
External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all…
Not rated