AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2020-13954

MEDIUM · CVSS 6.1 EPSS 42.99%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2020-11-12 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE
CVE-2020-13954
Severity
MEDIUM
CVSS
6.1
EPSS
42.99%
Apache Java

Original NVD Description

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.