CVE-2019-10180

Publication date 31 March 2020

Last updated 26 August 2025

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

2.4 · Low

Score breakdown

Description

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.

Status

Package Ubuntu Release Status
dogtag-pki 26.04 LTS resolute Not in release
25.10 questing Not in release
25.04 plucky Not in release
24.10 oracular Not in release
24.04 LTS noble Not in release
23.10 mantic
Not affected
23.04 lunar
Not affected
22.10 kinetic
Not affected
22.04 LTS jammy
Not affected
21.10 impish
Not affected
21.04 hirsute
Not affected
20.10 groovy
Not affected
20.04 LTS focal
Vulnerable
19.10 eoan Ignored end of life
18.04 LTS bionic
Vulnerable
16.04 LTS xenial Ignored end of standard support, was needs-triage
14.04 LTS trusty Not in release

Severity score breakdown

CVSS version: CVSS v3.0

Base score 2.4 · Low

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

References

Other references

Access our resources on patching vulnerabilities