CVE-2019-10177: XSS
First published: Thu Jun 27 2019(Updated: )
A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Cloudforms Management Engine | =5.9 | |
| Redhat Cloudforms Management Engine | =5.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-10177?
CVE-2019-10177 is a stored cross-site scripting (XSS) vulnerability found in the PDF export component of CloudForms.
What is the severity of CVE-2019-10177?
The severity of CVE-2019-10177 is medium with a CVSS score of 6.5.
How does CVE-2019-10177 affect Redhat Cloudforms Management Engine?
CVE-2019-10177 affects Redhat Cloudforms Management Engine versions 5.9 and 5.10.
How can an attacker exploit CVE-2019-10177?
An attacker with the least privilege to edit compute can execute a stored XSS attack against other users.
Are there any references for more information about CVE-2019-10177?
Yes, you can refer to the following links: [SecurityFocus](http://www.securityfocus.com/bid/109065) and [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10177).
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- vendor/redhat
- canonical/redhat cloudforms management engine
- version/redhat cloudforms management engine/5.9
- version/redhat cloudforms management engine/5.10