Non notée
CVE-2023-45757 Security vulnerability in Apache…
Description
Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page. Solution (choose one of three): 1. upgrade to bRPC > 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2411 3. disable rpcz feature
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache bRPC 0.9 | 0.9.0 → 1.6.0 | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
- www.openwall.com www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache bRPC
Les 41 CVE de Apache bRPC →
CVE-2026-90484
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a…
Non notée
CVE-2026-87849
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors…
Non notée
CVE-2026-86249
On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption…
Non notée
CVE-2026-86147
External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all…
Non notée