CVE-2019-6504: XSS
First published: Wed Feb 06 2019(Updated: )
Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, allow attackers to potentially conduct persistent cross site scripting (XSS) attacks via a crafted object.
Credit: vuln@ca.com vuln@ca.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Broadcom CA Automic Workload Automation | >=12.0<=12.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/106755
- https://communities.ca.com/community/product-vulnerability-response/blog/2019/01/24/ca20190124-01-security-notice-for-ca-automic-workload-automation
- https://marc.info/?l=bugtraq&m=154874504200510&w=2
- https://packetstormsecurity.com/files/151325/CA-Automic-Workload-Automation-12.x-Cross-Site-Scripting.html
- https://sec-consult.com/en/blog/advisories/cross-site-scripting-in-ca-automic-workload-automation-web-interface-formerly-automic-automation-engine/
- https://seclists.org/fulldisclosure/2019/Jan/61
- https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190124-01-security-notice-for-ca-automic-workload-automation.html
Frequently Asked Questions
What is the severity of CVE-2019-6504?
CVE-2019-6504 has a medium severity rating due to the potential for persistent XSS attacks.
How do I fix CVE-2019-6504?
To fix CVE-2019-6504, ensure you upgrade to a later version of CA Automic Workload Automation beyond 12.2.
What software is affected by CVE-2019-6504?
CVE-2019-6504 affects versions 12.0 to 12.2 of CA Automic Workload Automation.
What type of attack does CVE-2019-6504 allow?
CVE-2019-6504 allows for persistent cross site scripting (XSS) attacks due to insufficient output sanitization.
Who is the vendor for the product affected by CVE-2019-6504?
The vendor for the affected product is Broadcom.
- agent/type
- agent/severity
- agent/weakness
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/author
- agent/last-modified-date
- agent/event
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/broadcom
- canonical/broadcom ca automic workload automation
- version/broadcom ca automic workload automation/12.0
- version/broadcom ca automic workload automation/12.2