CVE-2018-16861
published 2018-12-07CVE-2018-16861: A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor…
PriorityP420medium4.8CVSS 3.0
AVNACLPRHUIRSCCLILAN
EPSS
0.88%
54.5th percentile
A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| the_foreman_project | foreman | — | — |
| the_foreman_project | foreman | — | — |
| the_foreman_project | foreman | — | — |
| theforeman | foreman | < 1.18.3 | 1.18.3 |
| theforeman | foreman | — | — |
| theforeman | foreman | >= 1.19.0 < 1.19.1 | 1.19.1 |
CVSS provenance
nvdv3.04.8MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vendor_redhat7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w3p6-8cgj-c9xc: A cross-site scripting (XSS) flaw was found in the foreman component of satellite
ghsa_unreviewed·2022-05-14
CVE-2018-16861 [MEDIUM] CWE-79 GHSA-w3p6-8cgj-c9xc: A cross-site scripting (XSS) flaw was found in the foreman component of satellite
A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.
Red Hat
foreman: stored XSS in success notification after entity creation
vendor_redhat·2018-09-04·CVSS 7.6
CVE-2018-16861 [HIGH] CWE-79 foreman: stored XSS in success notification after entity creation
foreman: stored XSS in success notification after entity creation
A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.
A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSR
No detection rules found.
No public exploits indexed.
2018-12-07
Published