CVE-2017-7535CWE-79

foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts

Medium · published July 26, 2018

CVSS v3.0
6.1
EPSS
1%
Percentile
73.9
In the wild
Unconfirmed
What it is

foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action.

The record
Technical detail
CVSS v3.0
6.1 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01487 · 73.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2018-07-26T13:00Z
EPSS history
Timeline
  • 26 JUL 13:00Z
    foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts
    cvelistv5