Read the docs
TI-2019-13948 Aliases CVE-2019-19336GHSA-969f-386j-4c9x

Cross-site scripting in Red Hat ovirt-engine

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.

Why it matters now

EPSS 0.00964 61st percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatovirt-engine4.3.8—No fix listedCNA
  • ovirt-engine VendorRed Hat Affected 4.3.8 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:ovirt:ovirt-engine:*:*:*:*:*:*:*:*before 4.3.8VulnerableoVirt
cpe:2.3:a:redhat:virtualization:4.3:*:*:*:*:*:*:*4.3VulnerableRed Hat
  • cpe:2.3:a:ovirt:ovirt-engine:*:*:*:*:*:*:*:* Versions before 4.3.8 Vulnerable ·oVirt
  • cpe:2.3:a:redhat:virtualization:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2020:3247 Released 2020-08-04 · Red Hat rating Important
    RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 novnc-1.1.0-1.el8ost, ovirt-engine-4.4.1.8-0.7.el8ev, ovirt-engine-api-explorer-0.0.6-1.el8ev +21
  • RHSA-2020:0498 Released 2020-02-13 · Red Hat rating Moderate
    Red Hat Virtualization Engine security, bug fix and enhancement update
    • RHV-M 4.3 ovirt-engine-4.3.8.2-0.4.el7, ovirt-engine-backend-4.3.8.2-0.4.el7, ovirt-engine-dbscripts-4.3.8.2-0.4.el7 +29

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2020:3247
RHV-M 4.3Fixed RHSA-2020:0498
Not affected: 1 product
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-19336
  2. 2026-10-03 Alias added: GHSA-969f-386j-4c9x

References

Advisory 1

  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
  • TI-2021-02511 Incorrect authorization in polkit KEVCVSS 3.1HIGH 7.8
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2015-00205 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and… CVSS 2.0HIGH 10.0
See all 127 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences