CVE-2019-10179

A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.

Score

CVSS 3.1 6.1 Medium

Status

Modified - secalert@redhat.com

Published

2020-03-20

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Dogtagpki (Dogtagpki)
• Enterprise Linux (Redhat)
• Pki-corepki-kra (Unknown)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10179