CVE-2016-6319: XSS
Cross-site scripting (XSS) vulnerability in app/helpers/formhelper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via the label parameter.
Other sources
Marek Hulán of Red Hat reports:
User can define a job template and specify input name containing JS code. When someone tries to invoke such job, the form is generated based on this name without proper escaping so the JS gets executed.
Upstream issue:
http://projects.theforeman.org/issues/16019
Proposed upstream patch:
https://github.com/theforeman/foreman/pull/3715/commits/4b63d2c7cdad76ed2bf96d9f8dff7e0c5cdabda6
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6319?
CVE-2016-6319 is classified as a medium-severity vulnerability due to its potential for Cross-site scripting (XSS) attacks.
How do I fix CVE-2016-6319?
To fix CVE-2016-6319, upgrade Foreman to version 1.12.2 or later.
Who disclosed CVE-2016-6319?
CVE-2016-6319 was reported by Marek Hulán of Red Hat.
What components are affected by CVE-2016-6319?
CVE-2016-6319 affects Foreman versions prior to 1.12.2, specifically impacting app/helpers/form_helper.rb.
What type of vulnerability is CVE-2016-6319?
CVE-2016-6319 is a Cross-site scripting (XSS) vulnerability.