Skip to content
Fencer Vulns
high 7.6

CVE-2018-16861 json

A cross-site scripting (XSS) flaw was found in the foreman component of satellite.

published 2018-12-07 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-8652

cvss
7.6
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.

Patch / fix

  • theforeman foreman 1.18.3, 1.19.1
  • v8 satellite capsule 6.5 1:3.14.5.10-19.el7sat
  • tfm satellite capsule 6.5, satellite 6.5 5.0-3.el7sat
  • kobo satellite capsule 6.5, satellite 6.5 0.5.1-1.el7sat
  • pulp satellite capsule 6.5, satellite 6.5 2.18.1.1-1.el7sat
  • gofer satellite capsule 6.5, satellite 6.5 2.12.5-3.el7sat
  • ostree satellite capsule 6.5, satellite 6.5 2017.1-2.atomic.el7
  • SOAPpy satellite capsule 6.5, satellite 6.5 0.11.6-17.el7
  • foreman satellite capsule 6.5, satellite 6.5 1.20.1.34-1.el7sat

red hat advisories RHSA-2019:1222

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-16861 updated cvss 7.6

foreman: stored XSS in success notification after entity creation

  • Red Hat Satellite 6.5 tfm 5.0-3.el7sat, kobo 0.5.1-1.el7sat, SOAPpy 0.11.6-17.el7, gofer 2.12.5-3.el7sat, liquibase 3.1.0-1.el7, pulp 2.18.1.1-1.el7sat, +397 more Red Hat Satellite Capsule 6.5 tfm 5.0-3.el7sat, kobo 0.5.1-1.el7sat, SOAPpy 0.11.6-17.el7, gofer 2.12.5-3.el7sat, pulp 2.18.1.1-1.el7sat, tfm-ror52 1.0-4.el7sat, +212 more
    fixed: vendor fix RHSA-2019:1222

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
NVD 3.0 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

  • The Foreman Project foreman

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.