CVE-2018-16887
Medium
Description
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Redhat Satellite
PublishedJan 13, 2019
First seenJan 13, 2019
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- theforeman katello3.9.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat satellite | 6.0 | — |
| theforeman katello | v < 3.9.0 | 3.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.