CVE-2016-6320: XSS
A stored cross-site scripting (XSS) flaw was found in the way input was escaped in the "Device Identifier" field when creating a new host in the Satellite web UI.
Other sources
Cross-site scripting (XSS) vulnerability in app/assets/javascripts/hosteditinterfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject arbitrary web script or HTML via the network interface device identifier in the host interface form.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6320?
The severity of CVE-2016-6320 is classified as medium due to its potential for exploitation via stored cross-site scripting.
How do I fix CVE-2016-6320?
To fix CVE-2016-6320, upgrade to Foreman version 1.12.2 or later where the vulnerability is patched.
What type of vulnerability is CVE-2016-6320?
CVE-2016-6320 is a stored cross-site scripting (XSS) vulnerability.
Which software versions are affected by CVE-2016-6320?
CVE-2016-6320 affects all versions of Foreman prior to 1.12.2.
What can attackers do with CVE-2016-6320?
Attackers exploiting CVE-2016-6320 can execute arbitrary JavaScript code in the context of an authenticated user's session.