CVE-2020-13954 Apache CXF Reflected XSS in the services listing page via the styleSheetPath
Attackers can inject JavaScript into the Apache CXF services listing page via the styleSheetPath parameter, potentially executing code in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-13954?
CVE-2020-13954 is a medium-severity cross-site scripting vulnerability in Apache Cxf, published on 12 Nov 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.
Weakness: CWE-79
Which versions are affected by CVE-2020-13954?
8 open source packages ship an affected version, including org.apache.cxf:apache-cxf and org.apache.cxf:cxf. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.cxf:apache-cxf Maven | All versions | 3.3.8 |
org.apache.cxf:apache-cxf Maven | All versions | 3.3.8 |
org.apache.cxf:apache-cxf Maven | From 3.4.0 | 3.4.1 |
org.apache.cxf:apache-cxf Maven | From 3.4.0 | 3.4.1 |
org.apache.cxf:cxf Maven | All versions | 3.3.8 |
org.apache.cxf:cxf Maven | All versions | 3.3.8 |
2 more packages
org.apache.cxf:cxf Maven | From 3.4.0 | 3.4.1 |
org.apache.cxf:cxf Maven | From 3.4.0 | 3.4.1 |
Products include Apache Cxf, Netapp Snap Creator Framework, Netapp Vasa Provider for Clustered Data Ontap, Oracle Business Intelligence, Oracle Communications Messaging Server, Oracle Retail Order Broker Cloud Service.
How do I fix CVE-2020-13954?
Upgrade org.apache.cxf:apache-cxf to a fixed version for your release line: 3.3.8 or 3.4.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-13954 being exploited?
There is no known exploitation of CVE-2020-13954 in the wild and no public exploit code.
Other vulnerabilities in Apache Cxf
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
Sources
Also known as GHSA-64x2-gq24-75pv.