Read the docs
TI-2019-07541 Aliases CVE-2019-10221GHSA-wfff-rc4w-hpx2

Cross-site scripting in [UNKNOWN] pki-core

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 15 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.

Why it matters now

EPSS 0.01322 71st percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 15 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]pki-coreall pki-core 10.x.x versions—No fix listedCNA
  • pki-core Vendor[UNKNOWN] Affected all pki-core 10.x.x versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:a:dogtagpki:dogtagpki:*:*:*:*:*:*:*:*10.0 – 10.8.3VulnerableDogtag PKI
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:dogtagpki:dogtagpki:*:*:*:*:*:*:*:* Versions 10.0 – 10.8.3 Vulnerable ·Dogtag PKI

Remediation

Red Hat 4 advisories

  • RHSA-2021:0975 Released 2021-03-23 · Red Hat rating Important
    pki-core security update
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) pki-base-10.5.16-7.el7_7, pki-base-java-10.5.16-7.el7_7, pki-ca-10.5.16-7.el7_7 +6
    • Red Hat Enterprise Linux Server EUS (v. 7.7) pki-base-10.5.16-7.el7_7, pki-base-java-10.5.16-7.el7_7, pki-ca-10.5.16-7.el7_7 +5
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.7) pki-base-10.5.16-7.el7_7, pki-base-java-10.5.16-7.el7_7, pki-ca-10.5.16-7.el7_7 +6
  • RHSA-2021:0851 Released 2021-03-16 · Red Hat rating Important
    pki-core security and bug fix update
    • Red Hat Enterprise Linux Client Optional (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +6
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +6
    • Red Hat Enterprise Linux Server (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +5
    • Red Hat Enterprise Linux Server Optional (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +6
    • Red Hat Enterprise Linux Workstation (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +5
    • Red Hat Enterprise Linux Workstation Optional (v. 7) pki-javadoc-10.5.18-12.el7_9
  • RHSA-2021:0819 Released 2021-03-15 · Red Hat rating Important
    pki-core security update
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) pki-base-10.5.9-15.el7_6, pki-base-java-10.5.9-15.el7_6, pki-ca-10.5.9-15.el7_6 +6
    • Red Hat Enterprise Linux Server EUS (v. 7.6) pki-base-10.5.9-15.el7_6, pki-base-java-10.5.9-15.el7_6, pki-ca-10.5.9-15.el7_6 +5
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.6) pki-base-10.5.9-15.el7_6, pki-base-java-10.5.9-15.el7_6, pki-ca-10.5.9-15.el7_6 +6
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) pki-base-10.5.9-15.el7_6, pki-base-java-10.5.9-15.el7_6, pki-ca-10.5.9-15.el7_6 +3
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) pki-base-10.5.9-15.el7_6, pki-base-java-10.5.9-15.el7_6, pki-ca-10.5.9-15.el7_6 +6
Show 1 more Red Hat advisories
  • RHSA-2020:4847 Released 2020-11-04 · Red Hat rating Moderate
    pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4847
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)Fixed RHSA-2021:0819
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7)Fixed RHSA-2021:0975
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2021:0819
Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:0975
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux Server Optional EUS (v. 7.6)Fixed RHSA-2021:0819
Red Hat Enterprise Linux Server Optional EUS (v. 7.7)Fixed RHSA-2021:0975
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2021:0851
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2021:0819
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2021:0819

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10221
  2. 2026-10-03 Alias added: GHSA-wfff-rc4w-hpx2

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences