CVE-2023-0119

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 54.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Satellite
Timeline
PublishedSep 12

Description

A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, and obtain user credentials.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-6fr9-c775-x826: A stored Cross-site scripting vulnerability was found in foreman↗2023-09-12
▶
CVEList
Foreman: stored cross-site scripting in host tab↗2023-09-12
▶

📋Vendor Advisories

1
Red Hat
Foreman: Stored cross-site scripting in host tab↗2023-03-12
▶