CVE-2016-8613CWE-79

A flaw was found in foreman 1.5.1

Medium · published July 31, 2018

CVSS v3.0
6.4
EPSS
2%
Percentile
83.8
In the wild
Unconfirmed
What it is

A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.

The record
Technical detail
CVSS v3.0
6.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.02396 · 83.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2018-07-31T20:00Z
EPSS history
Timeline
  • 31 JUL 20:00Z
    A flaw was found in foreman 1.5.1
    cvelistv5