CVE-2019-19336
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.
Key facts
- CVSS score
- 6.1 (v3.1)
- Severity
- MEDIUM
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
- CWE-79
- EPSS score
- 1.0% (61th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2019-8957)
- Published
- March 19, 2020
- NVD last modified
- June 17, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2019-8957 in the EU Vulnerability Database. Last updated in EUVD on August 5, 2024.
View on the EU Vulnerability DatabaseAffected products
- ovirt / ovirt-engine
- redhat / virtualization
Certified products that may be affected
1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.
- Red Hat Virtualization v4.3 - Red Hat, Inc. - Common Criteria OCSI/CERT/ATS/08/2020/RC - active
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19336(Issue Tracking, Third Party Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain