CVE-2019-10177
Last modified
CVE-2019-10177 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.. EPSS estimates a 0.96% chance of exploitation in the next 30 days.
Description
A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Cloudforms Management Engine | 5.9 |
| Redhat | Cloudforms Management Engine | 5.10 |
References
- http://www.securityfocus.com/bid/109065Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10177Issue Tracking, Vendor Advisory
- http://www.securityfocus.com/bid/109065Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10177Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10177?
How severe is CVE-2019-10177?
How do I fix CVE-2019-10177?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10171It was found that the fix for CVE-2018-14648 in 389-ds-base,…7.5
- CVE-2019-10172A flaw was found in org.codehaus.jackson:jackson-mapper-asl:…7.5
- CVE-2019-10173It was found that xstream API version 1.4.10 before 1.4.11 i…9.8
- CVE-2019-10174A vulnerability was found in Infinispan such that the invoke…8.8
- CVE-2019-10175A flaw was found in the containerized-data-importer in virt-…6.5
- CVE-2019-10176A flaw was found in OpenShift Container Platform, versions 3…4.2
- CVE-2019-10178It was found that the Token Processing Service (TPS) did not…6.1
- CVE-2019-10179A vulnerability was found in all pki-core 10.x.x versions, w…6.1
- CVE-2019-1018An elevation of privilege vulnerability exists when DirectX …7
- CVE-2019-10180A vulnerability was found in all pki-core 10.x.x version, wh…4.8
- CVE-2019-10181It was found that in icedtea-web up to and including 1.7.2 a…8.1
- CVE-2019-10182It was found that icedtea-web though 1.7.2 and 1.8.2 did not…8.2
Are you affected by CVE-2019-10177?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST