Back
CVE-2019-17573
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is…
Medium6.1EPSS 7.1%
- Published
- Updated
- Reserved
- Assigned by
- apache
Description
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 7.1% · top 5.8% of all CVEs (6 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.
Weakness
- Cross Site Scripting
- CWE-79 (opens in a new tab)All about CWE-79 and its CVEs
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.apache.cxf:apache-cxfGHSA-f93p-f762-vr53 (opens in a new tab)
- Mavenorg.apache.cxf:cxfGHSA-f93p-f762-vr53 (opens in a new tab)
References (14)
- [announce] 20200116 [CVE-2019-17573] Apache CXF Reflected XSS in the services listing page (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://www.oracle.com/security-alerts/cpujul2020.html (opens in a new tab)x_refsource_MISCx_transferred
- http://cxf.apache.org/security-advisories.data/CVE-2019-17573.txt.asc?version=1&modificationDate=1579178542000&api=v2 (opens in a new tab)x_refsource_CONFIRMx_transferred
- [cxf-dev] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [cxf-users] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [oss-security] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [announce] 20201112 CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [cxf-users] 20201125 RE: CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://www.oracle.com/security-alerts/cpuApr2021.html (opens in a new tab)x_refsource_MISCx_transferred
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-f93p-f762-vr53 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-17573)Record last updated .