CVE-2019-19336 Vulnerability Details

  /     /     /  

CVE-2019-19336 Metadata Quick Info

CVE Published: 19/03/2020 | CVE Updated: 05/08/2024 | CVE Year: 2019
Source: redhat | Vendor: Red Hat | Product: ovirt-engine
Status : PUBLISHED

---

CVE-2019-19336 Description

A cross-site scripting vulnerability was reported in the oVirt-engine\'s OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user\'s oVirt session.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-79
CWE Name: CWE-79
Source: Red Hat

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).