CVE-2017-15100

MEDIUM

Foreman < 1.16.0 - Stored Cross-Site Scripting via Fact Submission

Title source: llm
STIX 2.1

Description

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.

References (3)

Core 3
Core References
Issue Tracking, Patch x_refsource_confirm
https://github.com/theforeman/foreman/pull/4967
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2927
Issue Tracking, Vendor Advisory x_refsource_confirm
http://projects.theforeman.org/issues/21519

Scores

CVSS v3 6.1
EPSS 0.0110
EPSS Percentile 62.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (4)
Foreman Project/Foreman 1.2 and later, a fix is planned for 1.16.0
redhat/satellite 6.4
redhat/satellite_capsule 6.4
theforeman/foreman < 1.16.0
Published Nov 27, 2017
Tracked Since Feb 18, 2026