CVE-2016-8639: XSS
First published: Wed Nov 09 2016(Updated: )
It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/foreman | <1.13.0 | 1.13.0 |
| The Foreman | <1.13.0 | |
| Red Hat Satellite | =6.3 | |
| Red Hat Satellite | =6.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/94263
- https://access.redhat.com/errata/RHSA-2018:0336
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8639
- https://github.com/theforeman/foreman/pull/3523
- https://projects.theforeman.org/issues/15037
- http://projects.theforeman.org/issues/15037
- https://bugzilla.redhat.com/show_bug.cgi?id=1393291
Frequently Asked Questions
What is the severity of CVE-2016-8639?
CVE-2016-8639 is classified as a moderate severity vulnerability.
How do I fix CVE-2016-8639?
To fix CVE-2016-8639, upgrade to foreman version 1.13.0 or later.
Who is affected by CVE-2016-8639?
CVE-2016-8639 affects foreman versions before 1.13.0 and certain Red Hat Satellite versions.
What type of vulnerability is CVE-2016-8639?
CVE-2016-8639 is a stored cross-site scripting (XSS) vulnerability.
Can CVE-2016-8639 be exploited remotely?
Yes, CVE-2016-8639 can be exploited remotely by an attacker with privileges to set organization or location names.
- agent/type
- agent/first-publish-date
- agent/references
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-8639
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/theforeman
- canonical/the foreman
- vendor/redhat
- canonical/red hat satellite
- version/red hat satellite/6.3