Medium severity · published Oct 16, 2023
CVE-2023-45757
Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page
6.1
CVSS
1.2%
EPSS
No
On KEV
Description
Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page.
An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page.
Solution (choose one of three):
1. upgrade to bRPC > 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/
2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2411
3. disable rpcz feature
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
Brpc · Apache
before 1.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-45757
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-45757
Mailing List
http://www.openwall.com/lists/oss-security/2023/10/16/8
Mailing List
https://lists.apache.org/thread/6syxv32fqgl30brfpttrk4rfsb983hl4
More from Brpc
9.8
CVE-2025-60021
Apache bRPC: Remote command injection vulnerability in heap builtin service
9.8
CVE-2023-31039
Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file
7.5
CVE-2025-59789
Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser
7.5
CVE-2025-54472
Apache bRPC: Redis Parser Remote Denial of Service
7.5
CVE-2024-23452
Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request