CVE-2019-20921

mediumPriorität · verfolgen · 25EPSS 0.017 · 78. PerzentilDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.74% (78th) EPSS
CVSS 4.3 · medium
Is it mine?
45 products
Prüfe deine Angriffsfläche
Who says so?
6 sources
cnnvd · enisa_euvd · osv · cert_bund

EPSS · bewertet 2026-10-27

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenovirt-web-ui-0:1.6.7-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891

    https://access.redhat.com/errata/RHSA-2021:1169
  • Behobenovirt-web-ui-0:1.6.7-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891

    https://access.redhat.com/errata/RHSA-2021:1169
  • Behobenovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891

    https://access.redhat.com/errata/RHSA-2021:1186
  • Behobenovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891

    https://access.redhat.com/errata/RHSA-2021:1186
02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.1
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.7
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · OSV
v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · Red Hat Product Security US
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-79USprimärCWE-79USCWE-79US
04

betroffene Produkte (45)

Betroffene Produkte und Versionsbereiche.

20 von 45 angezeigt
05

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHSA-2021:1169Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] security, bug fix, enhancement2021-04-14csaf · redhat_csafUS

    An update is now available for Red Hat Virtualization Engine 4.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2021:1186Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] 0-day security, bug fix, enhance2021-04-14csaf · redhat_csafUS

    An update for org.ovirt.engine-root, ovirt-engine-ui-extensions, and ovirt-web-ui is now available for Red Hat Virtualization Engine 4.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • WID-SEC-W-2022-0808Red Hat Virtualization Engine: Mehrere SchwachstellenDeutsch2021-04-14csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in der Red Hat Virtualization Engine ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, beliebigen Code auszuführen, einen Denial of Service Zustand auszulösen und kryptographische Maßnahmen zu umgehen.

  • GHSA-7c82-mp33-r854Cross-site scripting in bootstrap-select2021-05-07ghsa · osvUS

    bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

  • GHSA-9r7h-6639-v5mwCross-Site Scripting in bootstrap-select2020-09-03ghsa · osvUS

    Versions of `bootstrap-select` prior to 1.13.6 are vulnerable to Cross-Site Scripting (XSS). The package does not escape `title` values on `<option>` tags. This may allow attackers to execute arbitrary JavaScript in a victim's browser. ## Recommendation Upgrade to version 1.13.6 or later.

06

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdosvcert_bundnvdredhat_csafNVDCVE.orgMITRE
veröffentlicht 2020-09-30geändert 2026-06-17
09

Referenzen (18)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan