---
id: CVE-2024-10033
title: 'Aap-gateway: xss on aap-gateway'
summary: >-
  A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS)
  vulnerability exists in the gateway component. This flaw allows a malicious
  user to perform actions that impact users by using the "?next=" in a URL,
  which can lead t…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Red Hat
product: aap-gateway
affected:
  - aap-gateway < 2.5.3
  - automation-gateway (all versions)
  - automation-gateway (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-10-16T17:37:00.293002Z'
published: '2024-10-16'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T11:40:16.669Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-10033'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:8534'
    label: 'RHSA-2024:8534'
  - url: 'https://access.redhat.com/security/cve/CVE-2024-10033'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2319162'
    label: RHBZ#2319162
tags:
  - cve.org
epss: 0.00395
epssPercentile: 0.33946
ingestedAt: '2026-11-05T21:36:00.819Z'
---

## Overview

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.

## Affected

- `aap-gateway < 2.5.3`
- `automation-gateway (all versions)`
- `automation-gateway (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.