Bug 1724241 (CVE-2019-10177) - CVE-2019-10177 CloudForms: Store XSS in PDF exports feature allows code execution of Javascript and HTML input
Summary: CVE-2019-10177 CloudForms: Store XSS in PDF exports feature allows code execu...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2019-10177
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1724970 1724971
Blocks: 1645012
TreeView+ depends on / blocked
 
Reported: 2019-06-26 14:21 UTC by Borja Tarraso
Modified: 2021-02-16 21:48 UTC (History)
16 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that PDF export component in CloudForms was vulnerable to cross-side scripting (XSS) as user input was not properly sanitized. An authenticated attacker with privileges to edit compute could use the XSS vulnerability against users, which could lead to arbitrary code execution, and extraction of the anti-CSRF token of a higher privileged user.
Clone Of:
Environment:
Last Closed: 2020-10-23 20:21:15 UTC
Embargoed:

Attachments (Terms of Use)

Description Borja Tarraso 2019-06-26 14:21:25 UTC 
A store cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could be leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users.
Comment 1 Borja Tarraso 2019-06-26 14:21:27 UTC 
Acknowledgments:

Name: Yadnyawalk Tale (Red Hat)
Comment 8 Product Security DevOps Team 2020-10-23 20:21:15 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10177
Note You need to log in before you can comment on or make changes to this bug.