GHSA-f93p-f762-vr53 · Severity: medium · Ecosystem: maven — Reflected Cross-Site Scripting in Apache CXF
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.
Conclusion & alert: CVE-2019-17573 is rated Moderate Risk (52.1/100): CVSS Medium severity, with high exploitation likelihood (EPSS 7.05%, 93th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 13.98% | 7.05% | -6.93% |
| 2 | 2026-05-11 | 16.13% | 13.98% | -2.14% |
| 3 | 2026-01-19 | — | 16.13% | — |
Full EPSS history (22 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 6.1 | 3.1 | MEDIUM |
|
2.8 | 2.7 | [email protected] |
| 4.3 | 2.0 | MEDIUM |
|
8.6 | 2.9 | [email protected] |
GHSA-f93p-f762-vr53 · Severity: medium · Ecosystem: maven — Reflected Cross-Site Scripting in Apache CXF
| vendor | priority | summary | link |
|---|---|---|---|
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2019-17573 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache | cxf | >= 3.2.0, <= 3.2.12 | cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* |
| apache | cxf | >= 3.3.0, < 3.3.5 | cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* |
| oracle | commerce_guided_search | 11.3.2 | cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* |
| oracle | communications_element_manager | 8.1.1 | cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* |
| oracle | communications_element_manager | 8.2.0 | cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* |
| oracle | communications_element_manager | 8.2.1 | cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* |
| oracle | communications_session_report_manager | 8.1.1 | cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* |
| oracle | communications_session_report_manager | 8.2.0 | cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* |
| oracle | communications_session_report_manager | 8.2.1 | cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* |
| oracle | communications_session_route_manager | 8.1.1 | cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* |
| oracle | communications_session_route_manager | 8.2.0 | cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* |
| oracle | communications_session_route_manager | 8.2.1 | cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* |
| oracle | flexcube_private_banking | 12.0.0 | cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* |
| oracle | flexcube_private_banking | 12.1.0 | cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* |
| oracle | retail_order_broker | 15.0 | cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* |