CVE-2018-16887

katello: stored XSS in subscriptions and repositories pages

Published Jan 13, 2019 CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-4568 A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
Github GHSA Github GHSA GHSA-mhhc-r88h-2qrm katello Cross-site Scripting vulnerability
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 10:39 AM
Reserved
Sep 11, 2018, 12:00 AM
Status
Modified
Published
Jan 13, 2019, 2:29 AM
Modified
Jun 17, 2026, 1:44 AM
Severity
Moderate
Public date
Oct 11, 2018, 12:00 AM