CVE-2019-10180: 
Linux Debian vulnerability analysis and mitigation

A vulnerability (CVE-2019-10180) was identified in all pki-core 10.x.x versions, specifically affecting the Token Processing Service (TPS). The vulnerability was discovered in June 2019 and involves improper sanitization of several parameters stored for tokens, which could result in a Stored Cross-Site Scripting (XSS) vulnerability (NVD, Debian Tracker).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 4.8 (Medium) from NVD with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while Red Hat assessed it with a lower score of 2.4 (Low) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N (NVD).

The vulnerability affects the pki-tps web UI in the table showing tokens. Several fields, including the User ID and policy, are not properly sanitized. The security consequences are limited due to the webUI using client-side TLS authentication, making cookie theft less impactful. The primary concern is potential website defacement (Red Hat Bugzilla).

The vulnerability was addressed in March 2021 through Red Hat Security Advisories RHSA-2021:0947 and RHSA-2021:0948. The fix was implemented via a commit in the Dogtag PKI repository that addressed multiple XSS vulnerabilities including CVE-2019-10180 (Red Hat Bugzilla).