CVE-2016-8639

foreman: Stored XSS via organization/location with HTML in name

Published Aug 1, 2018 CVSS 3.0 · 6.1 Medium EPSS 1.2% KEV · Not listed
Description
It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2016-9481 It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 2:27 AM
Reserved
Oct 12, 2016, 12:00 AM
Status
Modified
Published
Aug 1, 2018, 1:29 PM
Modified
Jun 17, 2026, 12:54 AM
Severity
Moderate
Public date
May 12, 2016, 12:00 AM