CVE-2018-16887
Last modified
CVE-2018-16887 is a vulnerability of currently unknown severity. A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. EPSS estimates a 1.00% chance of exploitation in the next 30 days.
Description
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Satellite | 6.0 |
| Theforeman | Katello | < 3.9.0 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16887Exploit, Issue Tracking, Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16887Exploit, Issue Tracking, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-16887?
How severe is CVE-2018-16887?
How do I fix CVE-2018-16887?
Are you affected by CVE-2018-16887?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST