A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.

Project Subscriptions

Vendors Products
Satellite Subscribe
Satellite Capsule Subscribe
Theforeman Subscribe
Katello Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2022-4568 A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
Github GHSA Github GHSA GHSA-mhhc-r88h-2qrm katello Cross-site Scripting vulnerability
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-05T10:39:57.671Z

Reserved: 2018-09-11T00:00:00

Link: CVE-2018-16887

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-01-13T02:29:00.217

Modified: 2024-11-21T03:53:32.283

Link: CVE-2018-16887

cve-icon Redhat

Severity : Moderate

Publid Date: 2018-10-11T00:00:00Z

Links: CVE-2018-16887 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses