CVE-2018-16887
published 2019-01-13CVE-2018-16887: A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is…
PriorityP424medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
1.00%
58.4th percentile
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| katello | katello | >= 0 < 3.9.0 | 3.9.0 |
| redhat | satellite | — | — |
| the_katello_project | katello | — | — |
| theforeman | katello | < 3.9.0 | 3.9.0 |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
katello Cross-site Scripting vulnerability
ghsa·2022-05-14
CVE-2018-16887 [MEDIUM] CWE-79 katello Cross-site Scripting vulnerability
katello Cross-site Scripting vulnerability
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
OSV
katello Cross-site Scripting vulnerability
osv·2022-05-14
CVE-2018-16887 [MEDIUM] katello Cross-site Scripting vulnerability
katello Cross-site Scripting vulnerability
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
Red Hat
katello: stored XSS in subscriptions and repositories pages
vendor_redhat·2018-10-11·CVSS 5.4
CVE-2018-16887 [MEDIUM] CWE-79 katello: stored XSS in subscriptions and repositories pages
katello: stored XSS in subscriptions and repositories pages
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execut
No detection rules found.
No public exploits indexed.
2019-01-13
Published