CVE-2019-10180 Cross-site scripting in pki-core
An attacker can inject malicious JavaScript into token parameters, tricking authenticated users into executing arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10180?
CVE-2019-10180 is a low-severity cross-site scripting vulnerability in [UNKNOWN] pki-core, published on 31 Mar 2020. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.
Weakness: CWE-79
Which versions are affected by CVE-2019-10180?
It affects 2 products.
Products include Dogtagpki Dogtagpki, Redhat Certificate System.
How do I fix CVE-2019-10180?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-10180 being exploited?
There is no known exploitation of CVE-2019-10180 in the wild and no public exploit code.
Other vulnerabilities in [UNKNOWN] pki-core
Sources
Also known as DEBIAN-CVE-2019-10180, GHSA-3r6g-5p5v-m39h, UBUNTU-CVE-2019-10180.