CVE-2019-19336

—

CVSS 3.1

6.1 medium

EPSS

<1%p60

Published

Mar 19, 2020 (Mar 19, 2020)

Modified

Jun 17, 2026

Description

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.

Vendors: ovirt redhat
Products: ovirt-engine, virtualization
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.