Description
A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can be executed when opening certain pages, for example, Host Collections.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | katello | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
References
- https://access.redhat.com/security/cve/CVE-2024-4812 vdb-entry
- RHBZ#2280187 issue-tracking