Read the docs
TI-2019-07498 Aliases CVE-2019-10177GHSA-gcg5-r76p-h8xr

Cross-site scripting in Red Hat CloudForms

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.

Why it matters now

EPSS 0.00943 61st percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatCloudForms5.9, 5.10—No fix listedCNA
  • CloudForms VendorRed Hat Affected 5.9, 5.10 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:cloudforms_management_engine:5.9:*:*:*:*:*:*:*5.9VulnerableRed Hat
cpe:2.3:a:redhat:cloudforms_management_engine:5.10:*:*:*:*:*:*:*5.10VulnerableRed Hat
  • cpe:2.3:a:redhat:cloudforms_management_engine:5.9:*:*:*:*:*:*:* Versions 5.9 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:cloudforms_management_engine:5.10:*:*:*:*:*:*:* Versions 5.10 Vulnerable ·Red Hat

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10177
  2. 2026-10-03 Alias added: GHSA-gcg5-r76p-h8xr

References

Advisory 1

  • TI-2013-01839 Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms… CVSS 2.0HIGH 9.4
  • TI-2013-01821 SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0… CVSS 2.0HIGH 7.5
  • TI-2016-04680 Code injection in [UNKNOWN] cfme CVSS 3.0HIGH 8.8
  • TI-2020-11195 OS command injection in CloudForms CVSS 3.1CRITICAL 9.1
  • TI-2019-11098 Improper input validation in [UNKNOWN] CloudForms CVSS 3.1HIGH 8.0
  • TI-2016-06078 Improper authorization in Red Hat CFME CVSS 3.0HIGH 8.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences