CWE Code: 79
Vulnerability Type: privilege_escalation
CVSS Score: 3.5
CWE Name:  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary: a cross-site scripting (xss) flaw was found in the katello component of satellite. an attacker with privilege to create/edit organizations and locations is able to execute a xss attacks against other users through the subscriptions or the red hat repositories wizards. this can possibly lead to malicious code execution and extraction of the anti-csrf token of higher privileged users. versions before 3.9.0 are vulnerable.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/NONE
Published Date: 2019-01-13
Last Modified Date: 2019-05-14