CVE-2019-10779

State: Published
Severity: Not scored
Published: Jan 28, 2020
Updated: Aug 4, 2024
Reserved: Apr 3, 2019

Description

All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An attacker website is able to load the Stroom UI into a hidden iframe. Using that iframe, the attacker site can issue commands to the Stroom UI via an XSS vulnerability to take full control of the Stroom UI on behalf of the logged-in user.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
stroom:stroom-appn/a	all versions before 5.5.12Affected all versions of the 6.0.0 branch before 6.0.25Affected

References

https://snyk.io/vuln/SNYK-JAVA-STROOM-541182

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.