PT-2017-13869 · Foreman · Foreman

Tbrisker · Published 2017-11-27 · Updated 2024-02-15 · CVE-2017-15100

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Foreman (affected versions not specified)

Description The issue allows an attacker to perform a stored XSS attack by submitting facts containing HTML to the Foreman server. This can lead to exploitation on certain pages, including the Facts page when the chart button is clicked and the chart is hovered over, the Trends page when checking a graph for a trend based on such a fact, and the Statistics page for aggregated facts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-15100

RHSA-2018:2927

Affected Products

Foreman

References · 5

• https://github.com/theforeman/foreman/pull/4967 · Patch
• https://access.redhat.com/errata/RHSA-2018:2927 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15100 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15100 · Vendor Advisory
• http://projects.theforeman.org/issues/21519 · Vendor Advisory