CVE-2018-16861

A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.

CVSS v3 7.6 HIGH
CVSS v2.0 3.5 LOW

7.6^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Exploitability : 2.1 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://access.redhat.com/errata/RHSA-2019:1222
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16861	Issue Tracking Patch Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1222
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16861	Issue Tracking Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:theforeman:foreman::::::::
	cpe:2.3:a:theforeman:foreman::::::::
	cpe:2.3:a:theforeman:foreman:1.20.0:rc1::::::
	cpe:2.3:a:theforeman:foreman:1.20.0:rc2::::::

History

21 Nov 2024, 03:53

Type	Values Removed	Values Added
CVSS	v2 : ~~3.5~~ v3 : ~~4.8~~	v2 : 3.5 v3 : 7.6
References	~~() https://access.redhat.com/errata/RHSA-2019:1222 -~~	() https://access.redhat.com/errata/RHSA-2019:1222 -
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16861 - Issue Tracking, Patch, Third Party Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16861 - Issue Tracking, Patch, Third Party Advisory

Information

Published : 2018-12-07 19:29

Updated : 2024-11-21 03:53

NVD link : CVE-2018-16861

Mitre link : CVE-2018-16861

CVE.ORG link : CVE-2018-16861

JSON object : View

Products Affected

theforeman

foreman

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2018-16861", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2018-12-07T19:29:00.193", "references": [{"url": "https://access.redhat.com/errata/RHSA-2019:1222", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16861", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2019:1222", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16861", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable."}, {"lang": "es", "value": "Se ha encontrado un error Cross-Site Scripting (XSS) en el componente \"satellite\" de Foreman. Un atacante con privilegios para crear entradas mediante los men\u00fas Hosts, Monitor, Infrastructure o Administer puede ejecutar ataques Cross-Site Scripting (XSS) contra otros usuarios, lo que podr\u00eda conducir a la ejecuci\u00f3n de c\u00f3digo malicioso y a la extracci\u00f3n del token anti-CSRF de usuarios con mayores privilegios. Las versiones anteriores a la 1.18.3, 1.19.1 y 1.20.0 de Foreman son vulnerables."}], "lastModified": "2024-11-21T03:53:28.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9670F448-B55D-4B3B-85AF-6BCFE331805B", "versionEndExcluding": "1.18.3"}, {"criteria": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "071F86C2-4E3C-4399-B83C-DA7A676C4343", "versionEndExcluding": "1.19.1", "versionStartIncluding": "1.19.0"}, {"criteria": "cpe:2.3:a:theforeman:foreman:1.20.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "616C28D2-04E7-4D7A-B1BA-C8B3B6872D6B"}, {"criteria": "cpe:2.3:a:theforeman:foreman:1.20.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "973FDBFF-5209-477C-A581-E86AC6DAEAF7"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}