CVE-2019-10180

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-31 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.

Affected products

Dogtag PKI: from 10.0 through 10.8.3
Red Hat Certificate System: 10.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10180
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10180

Get alerted when CVE-2019-10180 or the next vulnerability affects your stack