Read the docs
TI-2019-07469 Aliases CVE-2019-10146GHSA-9wr3-2hgg-f56c

Cross-site scripting in Red Hat pki-core

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.

Why it matters now

EPSS 0.00677 52nd percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatpki-coreall pki-core 10.x.x versions—No fix listedCNA
  • pki-core VendorRed Hat Affected all pki-core 10.x.x versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:dogtagpki:dogtagpki:*:*:*:*:*:*:*:*10.0 – 10.7.3VulnerableDogtag PKI
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:dogtagpki:dogtagpki:*:*:*:*:*:*:*:* Versions 10.0 – 10.7.3 Vulnerable ·Dogtag PKI

Remediation

Red Hat 4 advisories

  • RHSA-2021:0975 Released 2021-03-23 · Red Hat rating Important
    pki-core security update
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) pki-base-10.5.16-7.el7_7, pki-base-java-10.5.16-7.el7_7, pki-ca-10.5.16-7.el7_7 +6
    • Red Hat Enterprise Linux Server EUS (v. 7.7) pki-base-10.5.16-7.el7_7, pki-base-java-10.5.16-7.el7_7, pki-ca-10.5.16-7.el7_7 +5
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.7) pki-base-10.5.16-7.el7_7, pki-base-java-10.5.16-7.el7_7, pki-ca-10.5.16-7.el7_7 +6
  • RHSA-2021:0851 Released 2021-03-16 · Red Hat rating Important
    pki-core security and bug fix update
    • Red Hat Enterprise Linux Client Optional (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +6
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +6
    • Red Hat Enterprise Linux Server (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +5
    • Red Hat Enterprise Linux Server Optional (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +6
    • Red Hat Enterprise Linux Workstation (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +5
    • Red Hat Enterprise Linux Workstation Optional (v. 7) pki-javadoc-10.5.18-12.el7_9
  • RHSA-2021:0819 Released 2021-03-15 · Red Hat rating Important
    pki-core security update
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) pki-base-10.5.9-15.el7_6, pki-base-java-10.5.9-15.el7_6, pki-ca-10.5.9-15.el7_6 +6
    • Red Hat Enterprise Linux Server EUS (v. 7.6) pki-base-10.5.9-15.el7_6, pki-base-java-10.5.9-15.el7_6, pki-ca-10.5.9-15.el7_6 +5
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.6) pki-base-10.5.9-15.el7_6, pki-base-java-10.5.9-15.el7_6, pki-ca-10.5.9-15.el7_6 +6
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) pki-base-10.5.9-15.el7_6, pki-base-java-10.5.9-15.el7_6, pki-ca-10.5.9-15.el7_6 +3
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) pki-base-10.5.9-15.el7_6, pki-base-java-10.5.9-15.el7_6, pki-ca-10.5.9-15.el7_6 +6
Show 1 more Red Hat advisories
  • RHSA-2020:4847 Released 2020-11-04 · Red Hat rating Moderate
    pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4847
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)Fixed RHSA-2021:0819
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7)Fixed RHSA-2021:0975
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2021:0819
Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:0975
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux Server Optional EUS (v. 7.6)Fixed RHSA-2021:0819
Red Hat Enterprise Linux Server Optional EUS (v. 7.7)Fixed RHSA-2021:0975
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2021:0819
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2021:0819
Not affected: 1 product
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10146
  2. 2026-10-03 Alias added: GHSA-9wr3-2hgg-f56c

References

Advisory 1

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
See all 1955 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences