Skip to content
Fencer Vulns
medium 5.4

CVE-2019-19336 json

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8.

published 2020-03-19 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-8957

cvss
5.4
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.

Patch / fix

  • ovirt ovirt-engine 4.3.8
  • rhvm rhev manager 4.4 4.4.1.8-0.7.el8ev
  • novnc rhev manager 4.4 1.1.0-1.el8ost
  • ovirt-engine rhev manager 4.4 4.4.1.8-0.7.el8ev
  • rhvm-dependencies rhev manager 4.4 4.4.0-1.el8ev
  • ovirt-engine-setup rhev manager 4.4 4.4.1.8-0.7.el8ev
  • ovirt-engine-tools rhev manager 4.4 4.4.1.8-0.7.el8ev
  • ovirt-engine-backend rhev manager 4.4 4.4.1.8-0.7.el8ev
  • ovirt-engine-restapi rhev manager 4.4 4.4.1.8-0.7.el8ev

red hat advisories RHSA-2020:3247RHSA-2020:0498

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-19336 updated cvss 5.4

ovirt-engine: response_type parameter allows reflected XSS

  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.4.1.8-0.7.el8ev, ovirt-engine 4.4.1.8-0.7.el8ev, ovirt-engine-setup 4.4.1.8-0.7.el8ev, ovirt-engine-tools 4.4.1.8-0.7.el8ev, ovirt-engine-backend 4.4.1.8-0.7.el8ev, ovirt-engine-restapi 4.4.1.8-0.7.el8ev, +14 more
    fixed: vendor fix RHSA-2020:3247
  • Red Hat RHV-M 4.3 rhvm 4.3.8.2-0.4.el7, ovirt-web-ui 1.6.0-2.el7ev, ovirt-engine 4.3.8.2-0.4.el7, ovirt-engine-dwh 4.3.8-1.el7ev, ovirt-imageio-proxy 1.5.3-0.el7ev, ovirt-engine-setup 4.3.8.2-0.4.el7, +26 more
    fixed: vendor fix RHSA-2020:0498
  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 novnc 1.1.0-1.el8ost, snmp4j 2.4.1-1.el8ev, xmlrpc 3.1.3-1.el8ev, makeself 2.4.0-4.el8ev, log4j12 1.2.17-22.el8ev, m2crypto 0.35.2-5.el8ev, +100 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • Red Hat ovirt-engine

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.