CVE-2023-45757: falha em Apache bRPC
Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 1.2%
Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page.
An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page.
Solution (choose one of three):
1. upgrade to bRPC > 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/
2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2411
3. disable rpcz feature
Produtos afetados
Apache Software Foundation · Apache bRPCCVEs relacionadas — Apache bRPC
No mesmo produto, das mais perigosas para as menos.
CVE-2025-60021CRITICALApache bRPC: Remote command injection vulnerability in heap builtin serviceEPSS 25.7%CVE-2025-59789HIGHApache bRPC: Stack Exhaustion via Unbounded Recursion in JSON ParserEPSS 1.7%CVE-2024-23452HIGHApache bRPC: HTTP request smuggling vulnerabilityEPSS 1.6%CVE-2023-31039CRITICALApache bRPC: ServerOptions.pid_file may cause arbitrary code executionEPSS 1.5%CVE-2025-54472HIGHApache bRPC: Redis Parser Remote Denial of ServiceEPSS 1.3%CVE-2026-56388CRITICALApache bRPC: Out-of-Bounds Write in Redis Command ParserEPSS 1.0%