A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user i…

Published 7 y ago 2019-06-27 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.0 · CNA

CISA KEV

not known exploited

EPSS

0.9%

percentile 61%

Public exploits

none known

A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.

Exploit prediction (EPSS)

0.94% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L`
NVD	3.1	6.5	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L`
CNA	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L`
NVD	2.0	6.0	`AV:N/AC:M/Au:S/C:P/I:P/A:P`

Affected products

Red Hat CloudForms

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10177 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/109065 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2019-10177
NVD: CVE-2019-10177

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.