A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, and obtain user credentials.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:3387 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:6818 | |
| https://access.redhat.com/security/cve/CVE-2023-0119 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2159104 | Issue Tracking Vendor Advisory |
| https://projects.theforeman.org/issues/35977 | |
| https://access.redhat.com/errata/RHSA-2023:3387 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:6818 | |
| https://access.redhat.com/security/cve/CVE-2023-0119 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2159104 | Issue Tracking Vendor Advisory |
| https://projects.theforeman.org/issues/35977 |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 07:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/errata/RHSA-2023:3387 - Vendor Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:6818 - | |
| References | () https://access.redhat.com/security/cve/CVE-2023-0119 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2159104 - Issue Tracking, Vendor Advisory | |
| References | () https://projects.theforeman.org/issues/35977 - |
03 May 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-12 16:15
Updated : 2024-11-21 07:36
NVD link : CVE-2023-0119
Mitre link : CVE-2023-0119
CVE.ORG link : CVE-2023-0119
JSON object : View
Products Affected
redhat
- satellite
- enterprise_linux
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')