CVE-2024-4812: Katello: potential cross-site scripting exploit in ui
A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can be executed when opening certain pages, for example, Host Collections.
Other sources
A potential XSS issue within Foreman / Katello has been reported. It is possible to inject JavaScript code into the Description field of a User and save it. This code is then executed when opening certain pages (e.g., Host Collections).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4812?
CVE-2024-4812 has been classified as a high severity vulnerability due to the potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2024-4812?
To fix CVE-2024-4812, it is recommended to upgrade to the latest patched version of the Katello plugin for Foreman.
Which versions are affected by CVE-2024-4812?
CVE-2024-4812 affects all versions of the Katello plugin for Foreman and Red Hat Satellite 6.0.
What can attackers do with CVE-2024-4812?
Attackers can exploit CVE-2024-4812 to execute malicious JavaScript code in the context of a user’s browser, potentially leading to data theft and session hijacking.
Is CVE-2024-4812 related to other vulnerabilities?
CVE-2024-4812 is specifically related to XSS vulnerabilities and should be addressed alongside other security practices to mitigate similar risks.