Public Date:
1645201: CVE-2018-16861 foreman: stored XSS in success notification after entity creation
A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users.

Find out more about CVE-2018-16861 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v3 metrics

CVSS3 Base Score 7.6
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity Impact High
Availability Impact Low

Red Hat Security Errata

Platform Errata Release Date
Red Hat Satellite 6.5 for RHEL 7 (foreman) RHSA-2019:1222 2019-05-14
Red Hat Satellite 6.5 for RHEL 7 (foreman) RHSA-2019:1222 2019-05-14

Affected Packages State

Platform Package State
Red Hat Satellite 6 foreman Affected
Unless explicitly stated as not affected, all previous versions of packages in any minor update stream of a product listed here should be assumed vulnerable, although may not have been subject to full analysis.


This issue was discovered by Sanket Jagtap (Red Hat Pune India).
Last Modified