CVE-2023-45757

    Dashboard / Vulnerabilities / CVE-2023-45757

    CVE-2023-45757

    Published: 16 Oct 2023Last Modified: 28 Oct 2026

    Summary: Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability

    Details: Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page. Solution (choose one of three): 1. upgrade to bRPC > 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch:  https://github.com/apache/brpc/pull/2411 3. disable rpcz feature

    References: http://www.openwall.com/lists/oss-security/2023/10/16/8, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45757.json, https://lists.apache.org/thread/6syxv32fqgl30brfpttrk4rfsb983hl4, https://nvd.nist.gov/vuln/detail/CVE-2023-45757

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -14a18bcac6fca60fa8e6e4b3d222d6209de947c3

    Affected versions

    1.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-45757 | CVE-DB