PT-2018-5773 · Red Hat · Cloudforms

Published 2018-07-27 · Updated 2019-10-09 · CVE-2017-15125

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: CloudForms versions prior to 5.9.0.22

Description: A flaw in the self-service UI snapshot feature allows for stored XSS attacks due to improper sanitization of the name field for HTML and JavaScript input. This could enable an attacker to execute such an attack on an application administrator using CloudForms. However, Content Security Policy (CSP) prevents exploitation of this XSS, although not all browsers support CSP.

Recommendations: For versions prior to 5.9.0.22, update to version 5.9.0.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the self-service UI snapshot feature to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-15125

RHSA-2018:0380

Affected Products

Cloudforms

References · 5

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15125 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15125 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15125 · Security Note
• http://securityfocus.com/bid/102287 · Note