CVE-2020-1696: XSS

Q: What is CVE-2020-1696?

CVE-2020-1696 is a vulnerability found in all pki-core 10.x.x versions, allowing for Stored Cross-Site Scripting (XSS) attacks.

Q: What is the severity of CVE-2020-1696?

The severity of CVE-2020-1696 is medium with a score of 5.4.

Q: How does CVE-2020-1696 affect Redhat Certificate System?

Redhat Certificate System version 9.0 and 10.0 are affected by CVE-2020-1696.

Q: How does CVE-2020-1696 affect Dogtagpki Dogtagpki?

Dogtagpki Dogtagpki versions 10.0 to 10.8.3 are affected by CVE-2020-1696.

Q: How can I fix CVE-2020-1696?

To fix CVE-2020-1696, it is recommended to update to the latest version of pki-core.

Published Mar 20, 2020

Updated

A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a specially crafted Javascript code.

Affected Software

3 affected components

redhat Certificate System=9.0

redhat Certificate System=10.0

dogtagpki dogtagpki>=10.0<=10.8.3

Event History

Mar 20, 2020

CVE Published

via MITRE·01:58 PM

Data Sourced

via MITRE·01:58 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-1696?

CVE-2020-1696 is a vulnerability found in all pki-core 10.x.x versions, allowing for Stored Cross-Site Scripting (XSS) attacks.

What is the severity of CVE-2020-1696?

The severity of CVE-2020-1696 is medium with a score of 5.4.

How does CVE-2020-1696 affect Redhat Certificate System?

Redhat Certificate System version 9.0 and 10.0 are affected by CVE-2020-1696.

How does CVE-2020-1696 affect Dogtagpki Dogtagpki?

Dogtagpki Dogtagpki versions 10.0 to 10.8.3 are affected by CVE-2020-1696.

How can I fix CVE-2020-1696?