Medium severity · published Mar 19, 2020
CVE-2019-19336
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8
6.1
CVSS
1%
EPSS
No
On KEV
Description
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OV
Ovirt-engine · Ovirt
before 4.3.8 · source: NVD
VI
Virtualization · Redhat
4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-19336
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-19336
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19336
More from Ovirt-engine
7.8
CVE-2022-0847
Linux Kernel Privilege Escalation Vulnerability
7.8
CVE-2013-4367
ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod() works when…
7.5
CVE-2024-0822
An authentication bypass vulnerability was found in overt-engine
6.5
CVE-2020-35497
A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key
6.1
CVE-2022-3193
An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine