CVE-2019-10178: 
Linux Debian vulnerability analysis and mitigation

CVE-2019-10178 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Token Processing Service (TPS) of pki-core. The vulnerability was reported on June 10, 2019, affecting all versions of pki-core at the time. The issue stems from improper sanitization of Token IDs in the 'Activity' page of the PKI-TPS web interface (Debian Security, Red Hat Bugzilla).

The vulnerability exists due to improper sanitization of token ID input when adding a new token in the TPS's web page Activity tab. This security flaw allows for the storage and execution of arbitrary JavaScript code when the affected page is viewed in a browser (Red Hat Bugzilla).

The security consequences were assessed as limited due to the web UI's use of client-side TLS authentication, which makes cookie theft less impactful. The main concerns identified were potential webpage defacement and minor information disclosure, such as exposure of user information including name, email, and roles (Red Hat Bugzilla).

The vulnerability was addressed through security updates released by Red Hat on March 22, 2021, via RHSA-2021:0947 for Red Hat Certificate System 9.7 and RHSA-2021:0948 for version 9.4 EUS. The fix was implemented upstream through a commit that addressed multiple XSS vulnerabilities in TPS (Red Hat Bugzilla).