CVE-2017-12175: Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality

Medium severity · published Jul 26, 2018

CVE-2017-12175

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality

5.4

CVSS

1.1%

EPSS

On KEV

Description

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)1.1% · higher than 66% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Satellite · Redhat

before 6.5 · source: NVD

Affected product

Satellite

Redhat

All Satellite CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2017-12175

CVE.org

https://www.cve.org/CVERecord?id=CVE-2017-12175

Third Party Advisory

http://www.securityfocus.com/bid/101245

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:2927

Exploit

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12175

Exploit

https://projects.theforeman.org/issues/22042