{"id":"CVE-2024-10033","title":"Aap-gateway: xss on aap-gateway","summary":"A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the \"?next=\" in a URL, which can lead t…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Red Hat","product":"aap-gateway","affected":["aap-gateway < 2.5.3","automation-gateway (all versions)","automation-gateway (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-10-16T17:37:00.293002Z"},"published":"2024-10-16","updated":"2026-11-05","sourceUpdated":"2026-11-05T11:40:16.669Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-10033","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:8534","label":"RHSA-2024:8534"},{"url":"https://access.redhat.com/security/cve/CVE-2024-10033"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2319162","label":"RHBZ#2319162"}],"tags":["cve.org"],"epss":0.00395,"epssPercentile":0.33946,"ingestedAt":"2026-11-05T21:36:00.819Z","slug":"CVE-2024-10033","body":"## Overview\n\nA vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the \"?next=\" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.\n\n## Affected\n\n- `aap-gateway < 2.5.3`\n- `automation-gateway (all versions)`\n- `automation-gateway (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}