vulnwire
2.4low

CVE-2019-10180

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parame…

Published 6 y ago · modified 4 mo ago · JSON

CVSS
2.4
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 55%
Public exploits
0
none known

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.

Exploit prediction (EPSS)

0.73% probability of exploitation in the next 30 days, higher than 55% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.12.4CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
CNA3.12.4CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
NVD3.14.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVD2.03.5AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

  • [UNKNOWN] pki-core

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.