Description
A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a specially crafted Javascript code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | pki-core | all pki-core 10.x.x versions | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | dogtag-pki | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 18.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 16.04 LTS | dogtag-pki | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Certificate System Eus 9 | idm-console-framework | 1.1.17-4.el7dsrv | RHSA-2021:0948 |
| Red Hat Certificate System Eus 9 | pki-console | 10.5.9-2.el7pki | RHSA-2021:0948 |
| Red Hat Certificate System Eus 9 | pki-tks +3 | 10.5.9-15.el7pki | RHSA-2021:0948 |
| Red Hat Certificate System Eus 9 | redhat-pki-theme +2 | 10.5.9-5.el7pki | RHSA-2021:0948 |
| Red Hat Certificate System 9 | pki-tks +3 | 10.5.18-12.el7pki | RHSA-2021:0947 |
| Red Hat Certificate System 9 | redhat-pki-theme +2 | 10.5.18-5.el7pki | RHSA-2021:0947 |
Advisories 2
- RHSA-2021:0947 Red Hat Security Advisory: pki-core and redhat-pki-theme security and bug fix update Red Hat Security Advisories (RHSA) · Feb 24, 2026
- RHSA-2021:0948 Red Hat Security Advisory: Red Hat Certificate System security and bug fix update Red Hat Security Advisories (RHSA) · Feb 24, 2026