Описание
A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
It was found that the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
Отчет
This vulnerability is rated Low : the web UI uses client TLS authentication, therefore stealing session cookies will not be sufficient for unauthorized access. The vulnerable page itself does not contain secrets.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | pki-core | Not affected | ||
| Red Hat Enterprise Linux 7 | pki-core | Fixed | RHSA-2021:0851 | 16.03.2021 |
| Red Hat Enterprise Linux 7.6 Extended Update Support | pki-core | Fixed | RHSA-2021:0819 | 15.03.2021 |
| Red Hat Enterprise Linux 7.7 Extended Update Support | pki-core | Fixed | RHSA-2021:0975 | 23.03.2021 |
| Red Hat Enterprise Linux 8 | pki-core | Fixed | RHSA-2020:4847 | 04.11.2020 |
| Red Hat Enterprise Linux 8 | pki-deps | Fixed | RHSA-2020:4847 | 04.11.2020 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
A vulnerability was found in all pki-core 10.x.x versions, where the K ...
A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
ELSA-2021-0851: pki-core security and bug fix update (IMPORTANT)
EPSS
4.3 Medium
CVSS3