CVE-2018-16887: XSS
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
Other sources
A flaw was found in katello. An stored XSS in the subscriptions and repositories pages due to an improper sanitization of the new organization input field.
References: https://projects.theforeman.org/issues/25182
Upstream Patch: https://github.com/Katello/katello/pull/7757 https://projects.theforeman.org/projects/katello/repository/revisions/17451c950201bedec9bdd3748e17863b550a6be2
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-16887?
CVE-2018-16887 is classified as a moderate severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2018-16887?
To mitigate CVE-2018-16887, update the katello package to version 3.9.0 or later.
Who is affected by CVE-2018-16887?
CVE-2018-16887 affects users with privileges to create or edit organizations and locations in Satellite and Katello.
What types of attacks are possible with CVE-2018-16887?
An attacker could leverage CVE-2018-16887 to perform cross-site scripting attacks against other users.
What components are impacted by CVE-2018-16887?
CVE-2018-16887 impacts the katello component of Red Hat Satellite.