CVE-2016-8634

foreman: Stored XSS in org/loc wizard

Published Aug 1, 2018 CVSS 3.0 · 6.1 Medium EPSS 1.1% KEV · Not listed
Description
A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2016-9477 A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 2:27 AM
Reserved
Oct 12, 2016, 12:00 AM
Status
Modified
Published
Aug 1, 2018, 12:29 PM
Modified
Jun 17, 2026, 12:54 AM
Severity
Moderate
Public date
Nov 3, 2016, 12:00 AM