CVE-2023-0119
Fixed in a distro release EPSS <1%CVSS 5.4
A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, and obtain user credentials.
Products: Red Hat Satellite 6.13 for RHEL 8, Red Hat Satellite 6.14 for RHEL 8
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat satellite 6.13 | foreman | 0:3.5.1.17-1.el8sat |
| Red Hat satellite 6.14 | foreman | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-cli | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-debug | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-dynflow-sidekiq | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-ec2 | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-journald | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-libvirt | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-openstack | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-ovirt | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-postgresql | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-redis | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-service | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-telemetry | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | foreman-vmware | 0:3.7.0.9-1.el8sat |
| Red Hat satellite 6.14 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat satellite 6.14 | puppetserver | 0:7.11.0-1.el8sat |
| Red Hat satellite 6.14 | python-django | 0:3.2.21-1.el8pc |
| Red Hat satellite 6.14 | python-future | 0:0.18.3-1.el8pc |
| Red Hat satellite 6.14 | python-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite 6.14 | python-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat satellite 6.14 | python-requests | 0:2.31.0-1.el8pc |
| Red Hat satellite 6.14 | python-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat satellite 6.14 | python39-django | 0:3.2.21-1.el8pc |
| Red Hat satellite 6.14 | python39-future | 0:0.18.3-1.el8pc |
| Red Hat satellite 6.14 | python39-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite 6.14 | python39-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat satellite 6.14 | python39-requests | 0:2.31.0-1.el8pc |
| Red Hat satellite 6.14 | python39-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat satellite 6.14 | rubygem-actionpack | 0:6.1.7.3-1.el8sat |
| Red Hat satellite 6.14 | rubygem-activerecord | 0:6.1.7.3-1.el8sat |
| Red Hat satellite 6.14 | rubygem-activesupport | 0:6.1.7.3-1.el8sat |
| Red Hat satellite 6.14 | rubygem-git | 0:1.18.0-1.el8sat |
| Red Hat satellite 6.14 | rubygem-globalid | 0:1.1.0-1.el8sat |
| Red Hat satellite 6.14 | rubygem-kubeclient | 0:4.10.1-1.el8sat |
| Red Hat satellite 6.14 | rubygem-rack | 0:2.2.7-1.el8sat |
| Red Hat satellite 6.14 | yggdrasil-worker-forwarder | 0:0.0.3-1.el8sat |
| Red Hat satellite capsule 6.13 | foreman | 0:3.5.1.17-1.el8sat |
| Red Hat satellite capsule 6.14 | foreman | 0:3.7.0.9-1.el8sat |
| Red Hat satellite capsule 6.14 | foreman-debug | 0:3.7.0.9-1.el8sat |
| Red Hat satellite capsule 6.14 | puppet-agent | 0:7.26.0-3.el8sat |
| Red Hat satellite capsule 6.14 | puppetserver | 0:7.11.0-1.el8sat |
| Red Hat satellite capsule 6.14 | python-django | 0:3.2.21-1.el8pc |
| Red Hat satellite capsule 6.14 | python-future | 0:0.18.3-1.el8pc |
| Red Hat satellite capsule 6.14 | python-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite capsule 6.14 | python-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat satellite capsule 6.14 | python-requests | 0:2.31.0-1.el8pc |
| Red Hat satellite capsule 6.14 | python-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-django | 0:3.2.21-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-future | 0:0.18.3-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-gitpython | 0:3.1.32-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-pulp-ansible | 1:0.16.0-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-requests | 0:2.31.0-1.el8pc |
| Red Hat satellite capsule 6.14 | python39-sqlparse | 0:0.4.4-1.el8pc |
| Red Hat satellite capsule 6.14 | rubygem-rack | 0:2.2.7-1.el8sat |
| Red Hat satellite utils 6.13 | foreman | 0:3.5.1.17-1.el8sat |
| Red Hat satellite utils 6.14 | foreman | 0:3.7.0.9-1.el8sat |
| Red Hat satellite utils 6.14 | foreman-cli | 0:3.7.0.9-1.el8sat |