CVE-2018-16887: Cross-site Scripting

January 13, 2019 (updated May 14, 2019)

A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16887
nvd.nist.gov/vuln/detail/CVE-2018-16887

Code Behaviors & Features

Detect and mitigate CVE-2018-16887 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →