PT-2018-5773 · Red Hat · Cloudforms
Publicado
2018-07-27
·
Atualizado
2019-10-09
·
CVE-2017-15125
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions:
CloudForms versions prior to 5.9.0.22
Description:
A flaw in the self-service UI snapshot feature allows for stored XSS attacks due to improper sanitization of the
name field for HTML and JavaScript input. This could enable an attacker to execute such an attack on an application administrator using CloudForms. However, Content Security Policy (CSP) prevents exploitation of this XSS, although not all browsers support CSP.Recommendations:
For versions prior to 5.9.0.22, update to version 5.9.0.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the self-service UI snapshot feature to minimize the risk of exploitation.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cloudforms