CVE-2019-10146 MEDIUM

CVE-2019-10146

Vendor Red Hat

Product pki-core

Weakness CWE-79 · XSS

Published March 18, 2020

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

4.7/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.

Key dates

02Disclosure timeline

March 18, 2020 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-10146 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-6997 ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function CVE-2024-4722 Campcodes Complete Web-Based School Management System index.php cross site scripting CVE-2018-0251 CVE-2025-53926 Emlog has Stored Cross-site Scripting vulnerability due to error CVE-2024-4513 Campcodes Complete Web-Based School Management System timetable_update_form.php cross site scripting