CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath

Security readout for executives and security teams

Apache CXF exposed a default /services page that could reflect attacker-supplied JavaScript through styleSheetPath. If users could be lured to a crafted URL, script could run in their browser in the context of that CXF service page. The source bundle does not show active exploitation. Exposure is most likely where Apache CXF publishes its default /services listing to users, administrators, internal networks, or the internet. Systems on CXF 3.4.1, 3.3.8, or later are not described as affected in the provided Apache advisory. Treat this as a practical web exposure cleanup item, not an emergency based on the supplied evidence. Prioritize internet-facing or administrator-accessible CXF services first, then internal systems that handle sensitive workflows or privileged users. Mitigation focus: Upgrade Apache CXF to 3.4.1, 3.3.8, or a later supported release.; Inventory applications and dependencies that embed Apache CXF.; Check vendor guidance for disabling or restricting CXF services listing exposure..

Prepared

Jun 5, 2026, 13:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.