CVE-2020-13954: 
Java vulnerability analysis and mitigation

Apache CXF versions prior to 3.4.1 and 3.3.8 contain a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2020-13954). By default, Apache CXF creates a /services page containing a listing of available endpoint names and addresses. This webpage is vulnerable to a reflected XSS attack via the styleSheetPath parameter, which allows malicious actors to inject JavaScript into the web page (Apache Advisory).

The vulnerability exists in the services listing page of Apache CXF, specifically in the handling of the styleSheetPath parameter. When a malicious actor provides crafted input through this parameter, it can result in JavaScript code being injected and executed in the context of other users' browsers. This is a separate issue from the previously reported CVE-2019-17573 (MITRE CVE).

A successful exploitation of this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of other users' browsers who visit the affected services page. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (Apache Advisory).

The vulnerability is remotely exploitable without requiring authentication. An attacker can exploit this vulnerability by crafting a malicious URL that includes JavaScript code in the styleSheetPath parameter and convincing users to visit that URL (NVD).

Users should upgrade to Apache CXF version 3.3.8 or 3.4.1 or later to address this vulnerability. Alternatively, as a workaround, administrators can disable the service listing altogether by setting the 'hide-service-list-page' servlet parameter to 'true' (Apache Advisory).

The vulnerability was reported by Ryan Lambeth and was addressed promptly by the Apache CXF team. Various organizations including NetApp and Oracle have issued security advisories acknowledging the vulnerability in their products that utilize Apache CXF (NetApp Advisory).