CVE-2019-10177: XSS
A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10177?
CVE-2019-10177 is a stored cross-site scripting (XSS) vulnerability found in the PDF export component of CloudForms.
What is the severity of CVE-2019-10177?
The severity of CVE-2019-10177 is medium with a CVSS score of 6.5.
How does CVE-2019-10177 affect Redhat Cloudforms Management Engine?
CVE-2019-10177 affects Redhat Cloudforms Management Engine versions 5.9 and 5.10.
How can an attacker exploit CVE-2019-10177?
An attacker with the least privilege to edit compute can execute a stored XSS attack against other users.
Are there any references for more information about CVE-2019-10177?
Yes, you can refer to the following links: [SecurityFocus](http://www.securityfocus.com/bid/109065) and [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10177).