March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – IBM Sterling File Gateway Information Disclosure
November 17, 2020
Rewterz Threat Alert – Microsoft Office 365 Active Credential Phishing Campaign
November 18, 2020
Rewterz Threat Advisory – IBM Sterling File Gateway Information Disclosure
November 17, 2020
Rewterz Threat Alert – Microsoft Office 365 Active Credential Phishing Campaign
November 18, 2020
Severity
Medium
Analysis Summary
CVE-2020-13954
Apache CXF is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the services listing page. A remote attacker could exploit this vulnerability using the styleSheetPath in a specially-crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
Impact
Cross-site scripting
Affected Vendors
Apache
Affected Products
- Apache CXF 3.3.7
- Apache CXF 3.4.0
Remediation
Upgrade to the latest version of Apache CXF (3.3.8, 3.4.1 or later).