CVE-2019-17573

apache cxf, oracle commerce guided search, oracle communications element manager +4 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2019-17573

Katalog CVE

CVSS 6.1 · Medium EPSS 7,1%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada apache cxf, oracle commerce guided search +5 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.

Rincian

Terbit di NVD
16 Januari 2020
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari)
7,1% peluang dieksploitasi; lebih tinggi dari 94,0% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
apache cxf Versi 3.2.0 hingga 3.2.12
apache cxf Versi 3.3.0 hingga sebelum 3.3.5
oracle commerce guided search Versi 11.3.2
oracle communications element manager Versi 8.1.1
oracle communications element manager Versi 8.2.0
oracle communications element manager Versi 8.2.1
oracle communications session report manager Versi 8.1.1
oracle communications session report manager Versi 8.2.0
oracle communications session report manager Versi 8.2.1
oracle communications session route manager Versi 8.1.1
oracle communications session route manager Versi 8.2.0
oracle communications session route manager Versi 8.2.1
oracle flexcube private banking Versi 12.0.0
oracle flexcube private banking Versi 12.1.0
oracle retail order broker Versi 15.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.