VDB
CVE-2018-16861
CVE-2018-16861
PUBLISHED
CVSS 7.599999904632568 HIGH
A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.
EPSS 0.39% · 60.2th percentile
Risk Scores
CVSS 3.0
7.599999904632568
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
EPSS Score
0.39%
60.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| The Foreman Project | foreman | 1.18.3, 1.19.1, 1.20.0 |
| theforeman | foreman | 0, 1.20.0, 1.20.0 |
Exploit Intelligence
Timeline
- Dec 7, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score