CVEvulnerability

CVE-2019-10180

4.8 MEDIUM Published 2020-03-31 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-03-31
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.4 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-79

Description

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.

Affected configurations

• dogtagpki dogtagpki (>= 10.0 <= 10.8.3) • redhat certificate system 10.0

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References