CVE-2019-10177

Published: Jun 27, 2019Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Exploitability: 2.3 / Impact: 3.7

Source: NVD

Description

A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.

Affected (2)

Products: Redhat: Cloudforms Management Engine

1 product

Cloudforms Management Engine

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Cloudforms Management Engine	Version 5.10
Redhat Cloudforms Management Engine	Version 5.9

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

http://www.securityfocus.com/bid/109065

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10177

Source: secalert@redhat.com

Issue TrackingVendor Advisory

http://www.securityfocus.com/bid/109065

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10177

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.