PT-2017-13869 · Foreman · Foreman

Tbrisker · Publicado 2017-11-27 · Atualizado 2024-02-15 · CVE-2017-15100

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Foreman (affected versions not specified)

Description The issue allows an attacker to perform a stored XSS attack by submitting facts containing HTML to the Foreman server. This can lead to exploitation on certain pages, including the Facts page when the chart button is clicked and the chart is hovered over, the Trends page when checking a graph for a trend based on such a fact, and the Statistics page for aggregated facts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-15100

RHSA-2018:2927

Produtos afetados

Foreman

Referências · 5

• https://github.com/theforeman/foreman/pull/4967 · Correção
• https://access.redhat.com/errata/RHSA-2018:2927 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15100 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-15100 · Aviso do Fabricante
• http://projects.theforeman.org/issues/21519 · Aviso do Fabricante