CVE-2015-7518

Medium

Description

Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit forms.

SeverityMedium

CVSS4.3

Exploit probability—

ProductForeman

PublishedDec 17, 2015

First seenDec 17, 2015

How to fix

Vendor advisories

access.redhat.com/errata/RHSA-2016:0174

Affected products

Product	Affected versions	Fixed in
theforeman foreman	v ≤ 1.9.3	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.