CVE-2018-14664

foreman: Persisted XSS on all pages that use breadcrumbs

Published Oct 12, 2018 CVSS 3.0 · 5.4 Medium EPSS 1.1% KEV · Not listed
Description
A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2018-6559 A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 9:38 AM
Reserved
Jul 27, 2018, 12:00 AM
Status
Modified
Published
Oct 12, 2018, 10:15 PM
Modified
Jun 17, 2026, 1:41 AM
Severity
Moderate
Public date
Oct 10, 2018, 12:00 AM