CVE-2019-10177

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 43.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
RED HAT CloudformsRedhat Cloudforms Management Engine
Timeline
PublishedJun 27
Latest updateMay 24

Description

A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:LExploitability: 2.3 | Impact: 3.7

Affected Packages2 packages

▶CVEListV5red_hat/cloudforms5.9, 5.10

🔴Vulnerability Details

2
GHSA
GHSA-gcg5-r76p-h8xr: A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5↗2022-05-24
▶
CVEList
CVE-2019-10177: A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5↗2019-06-27
▶

📋Vendor Advisories

1
Red Hat
CloudForms: Store XSS in PDF exports feature allows code execution of Javascript and HTML input↗2019-06-27
▶

💬Community

1
Bugzilla
CVE-2019-10177 CloudForms: Store XSS in PDF exports feature allows code execution of Javascript and HTML input↗2019-06-26
▶