CVE-2017-15100

foreman: Stored XSS in fact name or value

Published Nov 27, 2017 CVSS 3.1 · 6.1 Medium EPSS 1.1% KEV · Not listed
Description
An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 7:50 PM
Reserved
Oct 8, 2017, 12:00 AM
Status
Modified
Published
Nov 27, 2017, 2:29 PM
Modified
Jun 17, 2026, 1:07 AM
Severity
Moderate
Public date
Oct 31, 2017, 12:00 AM