PT-2021-10081 · Pki-Core+3 · Pki-Core+3

Pedro Sampaio · Published 2020-11-03 · Updated 2021-05-10 · CVE-2020-1721

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: pki-core version 10.10.5

Description: A flaw in the Key Recovery Authority (KRA) Agent Service was found, which did not properly sanitize the recovery ID during a key recovery request. This enables a reflected cross-site scripting (XSS) vulnerability, allowing an attacker to trick an authenticated victim into executing specially crafted Javascript code.

Recommendations: For pki-core version 10.10.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CESA-2020_4847

CESA-2021_0851

CVE-2020-1721

RHSA-2020:4847

RHSA-2020_4847

RHSA-2021:0819

RHSA-2021:0851

RHSA-2021:0975

RHSA-2021_0851

RLSA-2020:4847

Affected Products

Centos

Red Hat

Rocky Linux

Pki-Core

References · 69

• 🔥 https://github.com/nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC · Exploit
• 🔥 https://github.com/sgdream/CVE-2020-1938 · Exploit
• 🔥 https://github.com/xindongzhuaizhuai/CVE-2020-1938 · Exploit
• 🔥 https://github.com/sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read · Exploit
• 🔥 https://github.com/laolisafe/CVE-2020-1938 · Exploit
• 🔥 https://github.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023 · Exploit
• 🔥 https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-1938 · Exploit
• 🔥 https://github.com/woaiqiukui/CVE-2020-1938TomcatAjpScanner · Exploit
• 🔥 https://github.com/halkichi0308/CVE-2015-9251 · Exploit
• 🔥 https://github.com/dacade/CVE-2020-1938 · Exploit
• 🔥 https://github.com/w4fz5uck5/CVE-2020-1938-Clean-Version · Exploit
• 🔥 https://github.com/fatal0/tomcat-cve-2020-1938-check · Exploit
• 🔥 https://github.com/Just1ceP4rtn3r/CVE-2020-1938-Tool · Exploit
• 🔥 https://github.com/YounesTasra-R4z3rSw0rd/CVE-2020-1938 · Exploit