Skip to content
Fencer Intel
medium 5.4

CVE-2019-19336 json

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8.

published 6y ago modified 4mo ago also EUVD-2019-8957

cvss
5.4
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.

Patch / fix

  • ovirt ovirt-engine 4.3.8
  • rhvm rhev manager 4.4 4.4.1.8-0.7.el8ev
  • novnc rhev manager 4.4 1.1.0-1.el8ost
  • ovirt-engine rhev manager 4.4 4.4.1.8-0.7.el8ev
  • rhvm-dependencies rhev manager 4.4 4.4.0-1.el8ev
  • ovirt-engine-setup rhev manager 4.4 4.4.1.8-0.7.el8ev
  • ovirt-engine-tools rhev manager 4.4 4.4.1.8-0.7.el8ev
  • ovirt-engine-backend rhev manager 4.4 4.4.1.8-0.7.el8ev
  • ovirt-engine-restapi rhev manager 4.4 4.4.1.8-0.7.el8ev

red hat advisories RHSA-2020:3247RHSA-2020:0498

Is CVE-2019-19336 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-19336 updated cvss 5.4

ovirt-engine: response_type parameter allows reflected XSS

  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.4.1.8-0.7.el8ev, ovirt-engine 4.4.1.8-0.7.el8ev, ovirt-engine-setup 4.4.1.8-0.7.el8ev, ovirt-engine-tools 4.4.1.8-0.7.el8ev, ovirt-engine-backend 4.4.1.8-0.7.el8ev, ovirt-engine-restapi 4.4.1.8-0.7.el8ev, +14 more
    fixed: vendor fix RHSA-2020:3247
  • Red Hat RHV-M 4.3 rhvm 4.3.8.2-0.4.el7, ovirt-web-ui 1.6.0-2.el7ev, ovirt-engine 4.3.8.2-0.4.el7, ovirt-engine-dwh 4.3.8-1.el7ev, ovirt-imageio-proxy 1.5.3-0.el7ev, ovirt-engine-setup 4.3.8.2-0.4.el7, +26 more
    fixed: vendor fix RHSA-2020:0498
  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 novnc 1.1.0-1.el8ost, snmp4j 2.4.1-1.el8ev, xmlrpc 3.1.3-1.el8ev, makeself 2.4.0-4.el8ev, log4j12 1.2.17-22.el8ev, m2crypto 0.35.2-5.el8ev, +100 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • Red Hat ovirt-engine

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.