PT-2020-9050 · Pki-Core+3 · Pki-Core+3

Pedro Sampaio · Published 2020-03-18 · Updated 2023-02-12 · CVE-2019-10146

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions pki-core versions 10.x.x

Description A Reflected Cross Site Scripting flaw was found in the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.

Recommendations For pki-core versions 10.x.x, ensure the CA Agent Service properly sanitizes the certificate request page to prevent the injection of specially crafted values. As a temporary workaround, consider restricting access to the certificate request page until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CESA-2020_4847

CESA-2021_0851

CVE-2019-10146

RHSA-2020:4847

RHSA-2020_4847

RHSA-2021:0819

RHSA-2021:0851

RHSA-2021:0975

RHSA-2021_0851

RLSA-2020:4847

Affected Products

Centos

Red Hat

Rocky Linux

Pki-Core

References · 72

• 🔥 https://github.com/nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC · Exploit
• 🔥 https://github.com/sgdream/CVE-2020-1938 · Exploit
• 🔥 https://github.com/xindongzhuaizhuai/CVE-2020-1938 · Exploit
• 🔥 https://github.com/sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read · Exploit
• 🔥 https://github.com/laolisafe/CVE-2020-1938 · Exploit
• 🔥 https://github.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023 · Exploit
• 🔥 https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-1938 · Exploit
• 🔥 https://github.com/woaiqiukui/CVE-2020-1938TomcatAjpScanner · Exploit
• 🔥 https://github.com/halkichi0308/CVE-2015-9251 · Exploit
• 🔥 https://github.com/dacade/CVE-2020-1938 · Exploit
• 🔥 https://github.com/w4fz5uck5/CVE-2020-1938-Clean-Version · Exploit
• 🔥 https://github.com/fatal0/tomcat-cve-2020-1938-check · Exploit
• 🔥 https://github.com/Just1ceP4rtn3r/CVE-2020-1938-Tool · Exploit
• 🔥 https://github.com/YounesTasra-R4z3rSw0rd/CVE-2020-1938 · Exploit