VULNERABILITY INTELLIGENCE

CVE-2019-10177

CVSS score6.5 MEDIUM

EPSS probability0.94%

CISA KEVNot currently listed

Published2019-06-27

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Description

A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

secalert@redhat.com — Third Party Advisory, VDB Entry
secalert@redhat.com — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory