CVE-2012-4543: XSS
Multiple cross-site scripting (XSS) flaws were found in the way:
1) 'displayCRL' script of Certificate System sanitized content of 'pageStart' and 'pageSize' variables provided in the query string,
2) 'profileProcess' script of Certificate System sanitized content of 'nonce' variable provided in the query string.
A remote attacker could provide a specially-crafted web page that, when visited by an unsuspecting Certificate System user would lead to arbitrary HTML or web script execution in the context of Certificate System user session.
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize to the displayCRL script, or (3) nonce variable to the profileProcess script.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4543?
CVE-2012-4543 is classified as a moderate severity vulnerability due to its cross-site scripting (XSS) flaws.
How do I fix CVE-2012-4543?
To fix CVE-2012-4543, update the pki-common package to version 8.1.3-2.el5 or later.
Which versions of Red Hat Certificate System are affected by CVE-2012-4543?
CVE-2012-4543 affects Red Hat Certificate System versions up to and including 8.1.1 and specific versions 7.1 to 8.1.
Which components are exploited by CVE-2012-4543?
CVE-2012-4543 exploits the 'displayCRL' and 'profileProcess' scripts within the Certificate System.
What are the implications of CVE-2012-4543?
Exploitation of CVE-2012-4543 could allow an attacker to execute arbitrary scripts in the context of a user's session.