CVE-2017-7535

foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action.

Score

CVSS 3.0 6.1 Medium

Status

Modified - secalert@redhat.com

Published

2018-07-26

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Foreman (Foreman)
• Foreman (Theforeman)

References

• http://seclists.org/oss-sec/2017/q3/521
• http://www.securityfocus.com/bid/99604
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7535
• https://projects.theforeman.org/issues/20963