Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 826646 - (CVE-2012-2662) CVE-2012-2662 Certificate System: multiple XSS flaws
CVE-2012-2662 Certificate System: multiple XSS flaws
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120719,repor...
: Reopened, Security
: 1221502 (view as bug list)
Depends On: 814478 1220423 1221900 1225670
Blocks: 822807 1193283 1221513
  Show dependency tree / graph
 
Reported: 2012-05-30 12:58 EDT by Tomas Hoger
Modified: 2018-01-30 13:05 EST (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System Agent and End Entity pages. An attacker could use these flaws to perform a cross-site scripting (XSS) attack against victims using the Certificate System's web interface.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-07-19 12:56:06 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1103 normal SHIPPED_LIVE Moderate: pki security and enhancement update 2012-07-19 15:53:12 EDT
Red Hat Product Errata RHSA-2015:1347 normal SHIPPED_LIVE Moderate: pki-core security and bug fix update 2015-07-20 14:07:50 EDT

  None (edit)
Description Tomas Hoger 2012-05-30 12:58:29 EDT 
Multiple cross-site scripting issues were discovered in the Red Hat Certificate System's / Dogtag Certificate System's Agent and End Entity pages.  An attacker could use these flaw to perform a cross-site scripting (XSS) attack against victims viewing Certificate System's web interface.

The issue was originally reported via bug #814478.

Following fixes were applied to address these issues:
https://fedorahosted.org/pki/changeset/2411
https://fedorahosted.org/pki/changeset/2414
https://fedorahosted.org/pki/changeset/2417
https://fedorahosted.org/pki/changeset/2426
Comment 2 errata-xmlrpc 2012-07-19 11:53:55 EDT 
This issue has been addressed in following products:

  Red Hat Certificate System 8

Via RHSA-2012:1103 https://rhn.redhat.com/errata/RHSA-2012-1103.html
Comment 3 Martin Prpič 2015-05-15 04:32:07 EDT 
*** Bug 1221502 has been marked as a duplicate of this bug. ***
Comment 4 Vasyl Kaigorodov 2015-07-14 08:45:11 EDT 
Statement:

This issue affects the versions of pki-core as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/
Comment 5 errata-xmlrpc 2015-07-22 02:55:23 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:1347 https://rhn.redhat.com/errata/RHSA-2015-1347.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.