CVE-2019-17573 Reflected Cross-Site Scripting in Apache CXF
Reflected XSS in Apache CXF default services page allows JavaScript injection, primarily affecting mobile applications due to browser behavior differences.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-17573?
CVE-2019-17573 is a medium-severity cross-site scripting vulnerability in Apache Cxf, published on 16 Jan 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.
Weakness: CWE-79
Which versions are affected by CVE-2019-17573?
8 open source packages ship an affected version, including org.apache.cxf:apache-cxf and org.apache.cxf:cxf. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.cxf:apache-cxf Maven | All versions | 3.2.12 |
org.apache.cxf:apache-cxf Maven | All versions | 3.2.12 |
org.apache.cxf:apache-cxf Maven | From 3.3.0 | 3.3.5 |
org.apache.cxf:apache-cxf Maven | From 3.3.0 | 3.3.5 |
org.apache.cxf:cxf Maven | All versions | 3.2.12 |
org.apache.cxf:cxf Maven | All versions | 3.2.12 |
2 more packages
org.apache.cxf:cxf Maven | From 3.3.0 | 3.3.5 |
org.apache.cxf:cxf Maven | From 3.3.0 | 3.3.5 |
Products include Apache Cxf, Oracle Commerce Guided Search, Oracle Communications Element Manager, Oracle Communications Session Report Manager, Oracle Communications Session Route Manager, Oracle Flexcube Private Banking and 1 more.
How do I fix CVE-2019-17573?
Upgrade org.apache.cxf:apache-cxf to a fixed version for your release line: 3.2.12 or 3.3.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-17573 being exploited?
There is no known exploitation of CVE-2019-17573 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Cxf
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
Sources
Also known as GHSA-f93p-f762-vr53.