Read the docs
TI-2019-02708 Aliases CVE-2019-3686GHSA-cf2f-f2vm-48vp

XSS in distri and version parameter in openQA

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

openQA before commit c172e8883d8f32fced5e02f9b6faaacc913df27b was vulnerable to XSS in the distri and version parameter. This was reported through the bug bounty program of Offensive Security

Why it matters now

EPSS 0.00621 50th percentileScored 2026-11-07
Fix Fixed openQA (SUSE): c172e8883d8f32fced5e02f9b6faaacc913df27b

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSEopenQAbefore c172e8883d8f32fced5e02f9b6faaacc913df27bc172e8883d8f32fced5e02f9b6faaacc913df27bPatch availableCNA
  • openQA VendorSUSE Affected before c172e8883d8f32fced5e02f9b6faaacc913df27b Fixed in c172e8883d8f32fced5e02f9b6faaacc913df27b Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:openqa:*:*:*:*:*:*:*:*before 2019-07-22VulnerableSUSE
  • cpe:2.3:a:suse:openqa:*:*:*:*:*:*:*:* Versions before 2019-07-22 Vulnerable ·SUSE

Remediation

  • Fix · CNA openQA (SUSE) Fixed in c172e8883d8f32fced5e02f9b6faaacc913df27b

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3686
  2. 2026-10-03 Alias added: GHSA-cf2f-f2vm-48vp
  3. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences