CVE-2020-1696

A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a specially crafted Javascript code.

Score

CVSS 3.1 5.4 Medium

Status

Modified - secalert@redhat.com

Published

2020-03-20

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Dogtagpki (Dogtagpki)
• Certificate System (Redhat)
• Pki-core (Unknown)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1696