Vulnerability Name: | CVE-2020-25715 (CCN-198239) | ||||||||||||||||||
Assigned: | 2020-09-16 | ||||||||||||||||||
Published: | 2021-03-02 | ||||||||||||||||||
Updated: | 2021-06-08 | ||||||||||||||||||
Summary: | A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity. | ||||||||||||||||||
CVSS v3 Severity: | 6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) 5.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N/E:H/RL:O/RC:C)
5.7 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N/E:H/RL:O/RC:C)
| ||||||||||||||||||
CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
| ||||||||||||||||||
Vulnerability Type: | CWE-79 | ||||||||||||||||||
Vulnerability Consequences: | Cross-Site Scripting | ||||||||||||||||||
References: | Source: MITRE Type: CNA CVE-2020-25715 Source: CCN Type: Red Hat Bugzilla Bug 1891016 (CVE-2020-25715) - CVE-2020-25715 pki-core: XSS in the certificate search results Source: MISC Type: Exploit, Issue Tracking, Patch, Third Party Advisory https://bugzilla.redhat.com/show_bug.cgi?id=1891016 Source: XF Type: UNKNOWN pkicore-cve202025715-xss(198239) Source: CCN Type: PKI GIT Repository Resolve XSS in ca queryCert pagination Source: CCN Type: WhiteSource Vulnerability Database CVE-2020-25715 | ||||||||||||||||||
Vulnerable Configuration: | Configuration 1: Configuration RedHat 1: Configuration RedHat 2: Configuration RedHat 3: Configuration RedHat 4: Configuration RedHat 5: ![]() | ||||||||||||||||||
Oval Definitions | |||||||||||||||||||
| |||||||||||||||||||
BACK |