Lucene search

Veracode Vulnerability DatabaseVERACODE:7623

HistoryOct 19, 2018 - 8:27 a.m.

Cross-site Scripting (XSS)

2018-10-1908:27:52

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

JSON

katello is vulnerable to a cross-site scripting (XSS) attack. The library does not properly encode the html tag in the organization’s name, allowing a malicious user to inject and execute arbitrary Javascript in a victim’s browser.

CPENameOperatorVersion
katellole3.8.1
rubygem-kafo_wizardseq0.0.1__1.el7ui
rubygem-kafo_wizardseq0.0.1__1.el7sat
tfm-rubygem-journald-loggereq2.0.3__1.el7sat
tfm-rubygem-extlibeq0.9.16__5.el7sat
tfm-rubygem-extlibeq0.9.16__4.el7sat
tfm-rubygem-extlibeq0.9.16__3.el7sat
tfm-rubygem-journald-nativeeq1.0.10__1.el7sat
tfm-rubygem-trollopeq2.1.2__2.el7sat
tfm-rubygem-trollopeq2.1.2__1.el7sat

Name	Operator	Version
katello	le	3.8.1
rubygem-kafo_wizards	eq	0.0.1__1.el7ui
rubygem-kafo_wizards	eq	0.0.1__1.el7sat
tfm-rubygem-journald-logger	eq	2.0.3__1.el7sat
tfm-rubygem-extlib	eq	0.9.16__5.el7sat
tfm-rubygem-extlib	eq	0.9.16__4.el7sat
tfm-rubygem-extlib	eq	0.9.16__3.el7sat
tfm-rubygem-journald-native	eq	1.0.10__1.el7sat
tfm-rubygem-trollop	eq	2.1.2__2.el7sat
tfm-rubygem-trollop	eq	2.1.2__1.el7sat

Rows per page:

1-10 of 11871

References

github.com/Katello/katello/commit/17451c950201bedec9bdd3748e17863b550a6be2

github.com/Katello/katello/pull/7757

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

JSON

Related for VERACODE:7623