CVE-2019-10180: Dogtagpki

Medium severity, CVSS 4.8. EPSS: 0.7% chance of exploitation in the next 30 days.

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.

Affected products

• Dogtagpki Dogtagpki: from 10.0, up to and including 10.8.3
• Red Hat Certificate System: version 10.0 only

Published 2020-03-31. Last modified 2026-06-17.