Skip to content
Sign in
5.4 Medium

CVE-2019-19336 A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version…

Description

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.

Affected products and versions

Product Affected versions Fixed in
ovirt-engine 4.3.8 No fix stated

Other CVEs of ovirt-engine

The 2 CVEs of ovirt-engine →
CVE-2017-15113 ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking 7.2 High
Track this CVE