CVE-2019-6504

Published: Feb 6, 2019Modified: Jun 17, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, allow attackers to potentially conduct persistent cross site scripting (XSS) attacks via a crafted object.

Affected (1)

Products: Broadcom: Automic Workload Automation

Broadcom

1 product

Automic Workload Automation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Broadcom Automic Workload Automation	From 12.0 to 12.2

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (14)

http://www.securityfocus.com/bid/106755

Source: vuln@ca.com

Third Party AdvisoryVDB Entry

https://communities.ca.com/community/product-vulnerability-response/blog/2019/01/24/ca20190124-01-security-notice-for-ca-automic-workload-automation

Source: vuln@ca.com

Vendor Advisory

https://marc.info/?l=bugtraq&m=154874504200510&w=2

Source: vuln@ca.com

Mailing ListThird Party Advisory

https://packetstormsecurity.com/files/151325/CA-Automic-Workload-Automation-12.x-Cross-Site-Scripting.html

Source: vuln@ca.com

Third Party AdvisoryVDB Entry

https://sec-consult.com/en/blog/advisories/cross-site-scripting-in-ca-automic-workload-automation-web-interface-formerly-automic-automation-engine/

Source: vuln@ca.com

Third Party Advisory

https://seclists.org/fulldisclosure/2019/Jan/61

Source: vuln@ca.com

Mailing ListThird Party Advisory

https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190124-01-security-notice-for-ca-automic-workload-automation.html

Source: vuln@ca.com

Vendor Advisory

http://www.securityfocus.com/bid/106755