CVE-2019-19336
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization...
5.4 MediumFix available
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
0.96%Up 0.5 points since Apr 14, 2021
What each source reports
CVE List Score used
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.
- Record
CVE-2019-19336- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2019-8957
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.
- Record
EUVD-2019-8957- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-969f-386j-4c9x No score
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization...
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.
- Record
GHSA-969f-386j-4c9x- Updated
- 2026-11-02
NVD
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.
- Record
CVE-2019-19336- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.
- Record
CVE-2019-19336- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2020:0498
Red Hat Security Advisory: Red Hat Virtualization Engine security, bug fix and enhancement update
- Record
RHSA-2020:0498- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2020:3247
Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update
- Record
RHSA-2020:3247- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ovirt-engineRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-backendRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-dbscriptsRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-dwhRed Hat:rhev_manager:4.3 |
before 0:4.3.8-1.el7ev | 0:4.3.8-1.el7ev |
ovirt-engine-dwh-setupRed Hat:rhev_manager:4.3 |
before 0:4.3.8-1.el7ev | 0:4.3.8-1.el7ev |
ovirt-engine-extensions-api-implRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-extensions-api-impl-javadocRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-health-check-bundlerRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-metricsRed Hat:rhev_manager:4.3 |
before 0:1.3.6.2-1.el7ev | 0:1.3.6.2-1.el7ev |
ovirt-engine-restapiRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
Show 47 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ovirt-engine-setupRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-setup-baseRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-setup-plugin-cinderlibRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-setup-plugin-ovirt-engineRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-setup-plugin-ovirt-engine-commonRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-setup-plugin-vmconsole-proxy-helperRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-setup-plugin-websocket-proxyRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-toolsRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-tools-backupRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-vmconsole-proxy-helperRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-webadmin-portalRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-engine-websocket-proxyRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
ovirt-fast-forward-upgradeRed Hat:rhev_manager:4.3 |
before 0:1.0.0-16.el7ev | 0:1.0.0-16.el7ev |
ovirt-imageio-commonRed Hat:rhev_manager:4.3 |
before 0:1.5.3-0.el7ev | 0:1.5.3-0.el7ev |
ovirt-imageio-common-debuginfoRed Hat:rhev_manager:4.3 |
before 0:1.5.3-0.el7ev | 0:1.5.3-0.el7ev |
ovirt-imageio-proxyRed Hat:rhev_manager:4.3 |
before 0:1.5.3-0.el7ev | 0:1.5.3-0.el7ev |
ovirt-imageio-proxy-setupRed Hat:rhev_manager:4.3 |
before 0:1.5.3-0.el7ev | 0:1.5.3-0.el7ev |
ovirt-web-uiRed Hat:rhev_manager:4.3 |
before 0:1.6.0-2.el7ev | 0:1.6.0-2.el7ev |
python2-ovirt-engine-libRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
rhv-log-collector-analyzerRed Hat:rhev_manager:4.3 |
before 0:0.2.15-0.el7ev | 0:0.2.15-0.el7ev |
rhvmRed Hat:rhev_manager:4.3 |
before 0:4.3.8.2-0.4.el7 | 0:4.3.8.2-0.4.el7 |
v2v-conversion-hostRed Hat:rhev_manager:4.3 |
before 0:1.16.0-3.el7ev | 0:1.16.0-3.el7ev |
v2v-conversion-host-ansibleRed Hat:rhev_manager:4.3 |
before 0:1.16.0-3.el7ev | 0:1.16.0-3.el7ev |
novncRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:1.1.0-1.el8ost | 0:1.1.0-1.el8ost |
ovirt-engineRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-api-explorerRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:0.0.6-1.el8ev | 0:0.0.6-1.el8ev |
ovirt-engine-backendRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-dbscriptsRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-health-check-bundlerRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-restapiRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setupRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-baseRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-cinderlibRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-imageioRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-ovirt-engineRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-ovirt-engine-commonRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-vmconsole-proxy-helperRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-setup-plugin-websocket-proxyRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-toolsRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-tools-backupRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-vmconsole-proxy-helperRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-webadmin-portalRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
ovirt-engine-websocket-proxyRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
python3-ovirt-engine-libRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
rhvmRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.1.8-0.7.el8ev | 0:4.4.1.8-0.7.el8ev |
rhvm-dependenciesRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:4.4.0-1.el8ev | 0:4.4.0-1.el8ev |
ovirt-engine-ui-extensionsRed Hat:rhev_manager:4.4:el8 From an advisory covering 8 CVEs |
before 0:1.2.2-1.el8ev | 0:1.2.2-1.el8ev |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-19336 is a medium vulnerability (CVSS 5.4) in Ovirt Ovirt-engine, published March 19, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in ovirt-engine 0:4.3.8.2-0.4.el7.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19336
nvd.nist.gov/vuln/detail/CVE-2019-19336
github.com/advisories/GHSA-969f-386j-4c9x
access.redhat.com/errata/RHSA-2020:0498
Show 194 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0498.json
cve.org/CVERecord?id=CVE-2019-19336
snyk.io/vuln/SNYK-JS-MINIMIST-559764
blog.jquery.com/2020/04/10/jquery-3-5-0-released
cisa.gov/known-exploited-vulnerabilities-catalog
This page doesn't list everything
Left out here: 93 references. The JSON record has them.