CVE-2020-13954

🎯 CVE-2020-13954 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2020-13954 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.

Klassifikation & Betroffenheit:

CWE-79 Apache Software Foundation Apache CXF unspecified <3.3.8Apache CXF unspecified <3.4.1apache cxf *netapp vasa_provider_for_clustered_data_ontap *oracle business_intelligence 5.5.0.0.0oracle business_intelligence 5.9.0.0.0oracle business_intelligence 12.2.1.3.0oracle business_intelligence 12.2.1.4.0

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 🎯 High

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

🛡️ Empfohlene Mitigation: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and …

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-63 · Cross-Site Scripting (XSS) (Very High) CAPEC-85 · AJAX Footprinting (Low) CAPEC-209 · XSS Using MIME Type Mismatch (Medium) CAPEC-588 · DOM-Based XSS (Very High) CAPEC-591 · Reflected XSS (Very High) CAPEC-592 · Stored XSS (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-67239 7.6 CVE-2026-67103 7.6 CVE-2026-54087 7.6 CVE-2026-32308 7.6 CVE-2026-26724 7.6

🩹 Patch verfügbar (OSV):

🩹 c8a3418e922a81bb5211de915a39d3987f84b27e (Commit) 🩹 e6bb26fed1cfa8d73b13f48f15a420be89dd7c41 (Commit)

🇩🇪 BSI-Sicherheitshinweise: BSI · hoch · Dell Data Protection Advisor: Mehrere Schwachstellen ↗ BSI · hoch · Oracle Fusion Middleware: Mehrere Schwachstellen ↗ BSI · IBM QRadar SIEM: Mehrere Schwachstellen ↗

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2020

Veröffentlicht 11/2020

Heute 22.10.

CVSS-Vektor-Analyse: 6.1

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Erforderlich

S · Scope Verändert

C · Vertraulichkeit Gering

I · Integrität Gering

A · Verfügbarkeit Keine

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Veröffentlicht:12.11.2020

Aktualisiert:17.06.2026 02:53

Assigner (CNA):apache

EUVD-ID:EUVD-2021-0770

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-79 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	725	0,2 %
≥50 %	3.224	0,9 %
≥10 %	22.086	5,9 %
<10 %	346.853	93,0 %

Noch keine Analyse zu CVE-2020-13954

Beitrag zu CVE-2020-13954 verfassen

Zero-Day & Vulnerability Intelligence Hub