CVE-2019-10180

4.8 mediumEPSS 0.7%

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2020-03-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dogtagpki:dogtagpki
redhat:certificate_system

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10180
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10180

Check your stack JSON