CVE-2017-15100: XSS
A cross-site scripting vulnerability was found in foreman in pages where facts are submitted through insertion of HTML in its name or value.
Upstream bug:
http://projects.theforeman.org/issues/21519
Other sources
An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2017-15100.
What is the severity level of CVE-2017-15100?
CVE-2017-15100 has a severity level of 6.1, which is considered medium.
What software is affected by CVE-2017-15100?
Theforeman Foreman versions up to and exclusive of 1.16.0 are affected by CVE-2017-15100.
How can an attacker exploit this vulnerability?
By submitting facts to the Foreman server containing HTML, an attacker can cause a stored XSS on certain pages.
Are there any references for further information on CVE-2017-15100?
Yes, you can find more information on CVE-2017-15100 at the following references: [1] http://projects.theforeman.org/issues/21519, [2] https://access.redhat.com/security/updates/classification/, [3] https://access.redhat.com/errata/RHSA-2018:2927.