CVE-2023-0119: Foreman: stored cross-site scripting in host tab

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-12 · updated 2026-06-17
Weakness: CWE-79

Description

A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, and obtain user credentials.

Affected products

Red Hat Satellite 6: 6.13

References

https://access.redhat.com/errata/RHSA-2023:3387
https://access.redhat.com/errata/RHSA-2023:6818
https://access.redhat.com/security/cve/CVE-2023-0119
https://bugzilla.redhat.com/show_bug.cgi?id=2159104
https://projects.theforeman.org/issues/35977
https://access.redhat.com/errata/RHSA-2023:3387
https://access.redhat.com/errata/RHSA-2023:6818
https://access.redhat.com/security/cve/CVE-2023-0119
https://bugzilla.redhat.com/show_bug.cgi?id=2159104
https://projects.theforeman.org/issues/35977

Get alerted when CVE-2023-0119 or the next vulnerability affects your stack