CVE-2018-14664CWE-79

A flaw was found in foreman from versions 1.18

Medium · published October 12, 2018

CVSS v3.0
5.4
EPSS
1%
Percentile
64.7
In the wild
Unconfirmed
What it is

A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01074 · 64.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2018-10-12T20:00Z
EPSS history
Timeline
  • 12 OCT 20:00Z
    A flaw was found in foreman from versions 1.18
    cvelistv5