CVE-2019-10146
pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page
Severity
LowRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · February 3, 2020
Updated · February 21, 2026
Description
A Reflected Cross Site Scripting flaw was found in the pki-ca module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.
Statement
This flaw is considered Low, because it requires the attacker to first request or predict a valid nonce. Without a valid nonce, no arbitrary HTML will be sent back to the victim's browser.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 4.7CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')