Unscored severity · published Jan 4, 2013
CVE-2012-4543
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1)…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize to the displayCRL script, or (3) nonce variable to the profileProcess script.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Certificate System · Redhat
through 8.1.1; 7.1; 7.2; 7.3; 8; 8.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4543
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4543
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1550.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0511.html
Vendor Advisory
http://secunia.com/advisories/51482
www.securityfocus.com
http://www.securityfocus.com/bid/56843
www.securitytracker.com
http://www.securitytracker.com/id?1027846
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=864397
More from Certificate System
8.1
CVE-2021-20179
A flaw was found in pki-core
6.5
CVE-2017-7509
An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1
5.7
CVE-2022-2393
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled
5.4
CVE-2020-1696
A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting…
4.8
CVE-2019-10180
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly…