CVE-2020-1696 Cross-site scripting in pki-core
An attacker can inject malicious JavaScript into Profile IDs in PKI Core TPS, leading to stored XSS and potential account takeover for authenticated users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-1696?
CVE-2020-1696 is a medium-severity cross-site scripting vulnerability in [UNKNOWN] pki-core, published on 20 Mar 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a specially crafted Javascript code.
Weakness: CWE-79
Which versions are affected by CVE-2020-1696?
It affects 2 products.
Products include Dogtagpki Dogtagpki, Redhat Certificate System.
How do I fix CVE-2020-1696?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-1696 being exploited?
There is no known exploitation of CVE-2020-1696 in the wild and no public exploit code.
Other vulnerabilities in [UNKNOWN] pki-core
Sources
Also known as DEBIAN-CVE-2020-1696, GHSA-59m3-5f56-55x8, UBUNTU-CVE-2020-1696.