Reflected Cross Site Scripting Vulnerability in pki-core by Red Hat
CVE-2019-10221

4.3MEDIUM

Key Information:

Vendor

[unknown]

Status
Pki-core
Vendor
CVE Published:
20 March 2020

What is CVE-2019-10221?

A security flaw exists in the pki-ca module of all pki-core 10.x.x versions, where inadequate sanitization of GET URL parameters enables attackers to execute arbitrary code. By crafting a malicious link, an attacker can deceive an authenticated user into clicking it, leading to the execution of harmful scripts in their web browser.

Affected Version(s)

pki-core all pki-core 10.x.x versions

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10221
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.