CVE-2019-10779
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2019
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An attacker website is able to load the Stroom UI into a hidden iframe. Using that iframe, the attacker site can issue commands to the Stroom UI via an XSS vulnerability to take full control of the Stroom UI on behalf of the logged-in user.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
stroom:stroom-app
- Vendor
- n/a
- Product
- stroom:stroom-app
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| all versions before 5.5.12 | affected | Unavailable | Unavailable | Unavailable | None listed |
| all versions of the 6.0.0 branch before 6.0.25 | affected | Unavailable | Unavailable | Unavailable | None listed |