PT-2020-10909 · Offensive Security · Openqa

Johannes Segitz · Published 2020-01-17 · Updated 2020-01-27 · CVE-2019-3686

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions openQA versions before commit c172e8883d8f32fced5e02f9b6faaacc913df27b

Description The issue concerns an XSS vulnerability in the distri and version parameters. This was reported through the bug bounty program of Offensive Security.

Recommendations For versions before commit c172e8883d8f32fced5e02f9b6faaacc913df27b, consider restricting access to the distri and version parameters until a fix is applied. Avoid using these parameters in sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-3686

Affected Products

Openqa

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-3686 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3686 · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1142849 · Note