CVE-2018-16861

    Dashboard / Vulnerabilities / CVE-2018-16861

    CVE-2018-16861

    Published: 7 Dec 2018Last Modified: 8 Jul 2026

    Summary:

    Details: A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.

    References: https://access.redhat.com/errata/RHSA-2019:1222, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16861

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -fa52e54e08c0ee7fc0445dd709033a9b755e3b46

    Affected versions

    1.20.0-rc1
    1.20.0-rc2
    1.20.0-RC2
    1.20.0-RC1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High