PT-2018-5033 · Foreman · Foreman

Ivan Necas · Publicado 2018-07-31 · Atualizado 2023-02-12 · CVE-2016-8613

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Foreman version 1.5.1

Description A flaw in the remote execution plugin allows commands to be run on hosts over SSH from the Foreman web UI. When a job containing HTML tags is submitted, the console output in the web UI does not escape the output, causing any HTML or JavaScript to run in the user's browser. This results in a stored XSS issue, as the output of the job is stored.

Recommendations For Foreman version 1.5.1, update to a version that includes a fix for this issue to prevent stored XSS attacks. As a temporary workaround, consider disabling the remote execution plugin until a patch is available. Restrict access to the web UI to minimize the risk of exploitation. Avoid submitting jobs with HTML tags in the affected Foreman version until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-8613

RHSA-2018:0336

Produtos afetados

Foreman

Referências · 6

• https://github.com/theforeman/foreman_remote_execution/pull/208 · Nota
• https://projects.theforeman.org/issues/17066 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-8613 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8613 · Correção
• http://securityfocus.com/bid/93859 · Nota
• https://osv.dev/vulnerability/CVE-2016-8613 · Aviso do Fabricante