GHSA-mhhc-r88h-2qrm

    Dashboard / Vulnerabilities / GHSA-mhhc-r88h-2qrm

    GHSA-mhhc-r88h-2qrm

    Published: 14 May 2022Last Modified: 8 Nov 2023

    Summary: katello Cross-site Scripting vulnerability

    Details: A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.

    References: https://nvd.nist.gov/vuln/detail/CVE-2018-16887, https://access.redhat.com/errata/RHSA-2019:1222, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16887, https://github.com/Katello/katello, https://github.com/rubysec/ruby-advisory-db/blob/master/gems/katello/CVE-2018-16887.yml

    Affected packages

    Package

    Name: katello

    Purl: pkg:gem/katello

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.9.0

    Affected versions

    1.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-mhhc-r88h-2qrm | CVE-DB