PT-2020-10139 · Ovirt · Ovirt Engine

Published 2020-03-19 · Updated 2020-03-23 · CVE-2019-19336

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions oVirt-engine versions prior to 4.3.8

Description A cross-site scripting issue was reported in the OAuth authorization endpoint. The flaw occurs because URL parameters are included in the HTML response without proper escaping, allowing an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.

Recommendations For versions prior to 4.3.8, update to version 4.3.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the OAuth authorization endpoint until the update can be applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19336

RHSA-2020:0498

RHSA-2020:3247

Affected Products

Ovirt Engine

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-19336 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19336 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19336 · Note