VDB
CVE-2018-16861
CVE-2018-16861
PUBLISHED
CVSS 7.599999904632568 HIGH
A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.
EPSS 0.88% · 57.4th percentile
Risk Scores
CVSS 3.0
7.599999904632568
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
EPSS Score
0.88%
57.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| The Foreman Project | foreman | 1.18.3, 1.19.1, 1.20.0 |
| theforeman | foreman | 0, 1.20.0, 1.20.0 |
Timeline
- Dec 7, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Oct 27, 2021 EPSS Score
- Dec 30, 2021 EPSS Score
- Mar 3, 2022 EPSS Score
- May 5, 2022 EPSS Score
- Jul 7, 2022 EPSS Score
- Sep 9, 2022 EPSS Score
- Nov 11, 2022 EPSS Score
- Jan 13, 2023 EPSS Score
References
- RHSA-2019:1222 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-16861 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16861 issue