CVE-2019-6504

MEDIUM

Broadcom Automic Workload Automation 12.0-12.2 - Stored Cross-Site Scripting in Automic Web Interface

Title source: llm

Description

Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, allow attackers to potentially conduct persistent cross site scripting (XSS) attacks via a crafted object.

References (7)

Core 7

Core References

Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq

https://marc.info/?l=bugtraq&m=154874504200510&w=2

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/106755

Third Party Advisory x_refsource_misc

https://sec-consult.com/en/blog/advisories/cross-site-scripting-in-ca-automic-workload-automation-web-interface-formerly-automic-automation-engine/

Third Party Advisory, VDB Entry x_refsource_misc

https://packetstormsecurity.com/files/151325/CA-Automic-Workload-Automation-12.x-Cross-Site-Scripting.html

Vendor Advisory x_refsource_misc

https://communities.ca.com/community/product-vulnerability-response/blog/2019/01/24/ca20190124-01-security-notice-for-ca-automic-workload-automation

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

https://seclists.org/fulldisclosure/2019/Jan/61

Vendor Advisory x_refsource_misc

https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190124-01-security-notice-for-ca-automic-workload-automation.html

Scores

CVSS v3 6.1

EPSS 0.0088

EPSS Percentile 75.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

broadcom/automic_workload_automation 12.0 - 12.2

Published Feb 06, 2019

Tracked Since Feb 18, 2026