What is CVE-2019-10779?

CVE-2019-10779 is a medium-severity vulnerability in Gchq Stroom, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-01-28.

How severe is CVE-2019-10779?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Is CVE-2019-10779 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Gchq Stroom

CVE-2019-10779

All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An attacker website is able to load the Stroom UI into a hidden iframe. Using that iframe, the attacker site can issue commands to the Stroom UI via an XSS vulnerability to take full control of the Stroom UI on behalf of the logged-in user.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.009 (56.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Gchq Stroom
N/a Stroom:stroom-app — versions all versions before 5.5.12, all versions of the 6.0.0 branch before 6.0.25

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

report@snyk.io (x_refsource_CONFIRM, Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2019-10779?: CVE-2019-10779 is a medium-severity vulnerability in Gchq Stroom, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-01-28.
How severe is CVE-2019-10779?: Medium severity. CVSS v3 base score is 6.1 out of 10.
Is CVE-2019-10779 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.