CVE-2019-10179

Name of the Vulnerable Software and Affected Versions pki-core versions 10.x.x

Description A vulnerability was found in the Key Recovery Authority (KRA) Agent Service where it did not properly sanitize the recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.

Recommendations For pki-core versions 10.x.x, update to a version that properly sanitizes the recovery request search page to prevent Reflected Cross Site Scripting (XSS) attacks. As a temporary workaround, consider restricting access to the KRA Agent Service to minimize the risk of exploitation.