Lucene search

K
osvGoogleOSV:CVE-2019-9580
HistoryMar 09, 2019 - 4:29 a.m.

CVE-2019-9580

2019-03-0904:29:00
Google
osv.dev
3

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

40.8%

In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a “null” origin value, potentially leading to XSS.

CPENameOperatorVersion
st2eq0.12.3
st2eq0.8.0
st2eq0.8.1
st2eq0.8.2

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

40.8%