Stored Cross-Site Scripting in PKI Core Token Processing Service
CVE-2020-1696

4.6MEDIUM

Key Information:

Vendor

[unknown]

Status
Pki-core
Vendor
CVE Published:
20 March 2020

What is CVE-2020-1696?

A security flaw in all versions of pki-core 10.x.x allows for stored Cross-Site Scripting (XSS) through the Token Processing Service (TPS). The vulnerability arises from insufficient sanitization of Profile IDs utilized in the service, permitting attackers with adequate permissions to manipulate authenticated users into executing hostile JavaScript code. This poses significant risks, including the potential for unauthorized data access and compromise of user accounts.

Affected Version(s)

pki-core all pki-core 10.x.x versions

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1696
x_refsource_CONFIRM

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.