CVE-2017-15100
Medium
Description
An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Foreman
PublishedNov 27, 2017
First seenNov 27, 2017
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- theforeman foreman1.16.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| theforeman foreman | v < 1.16.0 | 1.16.0 |
| redhat satellite | 6.4 | — |
| redhat satellite_capsule | 6.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.