Vulnerability Details : CVE-2019-10779

All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An attacker website is able to load the Stroom UI into a hidden iframe. Using that iframe, the attacker site can issue commands to the Stroom UI via an XSS vulnerability to take full control of the Stroom UI on behalf of the logged-in user.
Published 2020-01-28 01:15:11
Updated 2020-01-29 20:10:31
Source Snyk
View at NVD,   CVE.org
Vulnerability category: Cross site scripting (XSS)

Exploit prediction scoring system (EPSS) score for CVE-2019-10779

EPSS FAQ
0.09%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 36 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-10779

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
4.3
 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N
8.6
2.9
 NIST
6.1
 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2.8
2.7
 NIST

CWE ids for CVE-2019-10779

References for CVE-2019-10779

Products affected by CVE-2019-10779

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close