CVE-2016-6320
MEDIUMForeman <1.12.2 - XSS
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject arbitrary web script or HTML via the network interface device identifier in the host interface form.
References (6)
Scores
CVSS v3
5.4
EPSS
0.0035
EPSS Percentile
57.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Classification
CWE
CWE-79
Status
published
Affected Products (2)
theforeman/foreman
< 1.12.1
n/a/n/a
Timeline
Published
Aug 19, 2016
Tracked Since
Feb 18, 2026