PT-2020-9057 · Pki-Core+1 · Pki-Core+1

Published 2020-03-31 · Updated 2023-02-12 · CVE-2019-10180

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions pki-core versions 10.x.x

Description A vulnerability was found in the Token Processing Service (TPS) where it did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.

Recommendations For pki-core versions 10.x.x, ensure that the Token Processing Service (TPS) properly sanitizes parameters stored for the tokens to prevent Stored Cross Site Scripting (XSS) attacks. As a temporary workaround, consider restricting access to the TPS until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10180

RHSA-2021:0947

RHSA-2021:0948

Affected Products

Debian

Pki-Core

References · 10

• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10180 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10180 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10180 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10180 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10180 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10180 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10180 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10180 · Note
• https://t.me/cibsecurity/10887 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=1721137 · Note