CVE-2018-16887

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-01-13 · updated 2026-06-17
Weakness: CWE-79

Description

A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.

Affected products

Red Hat Satellite 6: 6.0
Katello: before 3.9.0 — fixed in 3.9.0

How to fix

Upgrade to a fixed version: Katello 3.9.0. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2019:1222
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16887
https://access.redhat.com/errata/RHSA-2019:1222
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16887

Get alerted when CVE-2018-16887 or the next vulnerability affects your stack