Cross-site scripting (XSS) vulnerability in app/helpers/formhelper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via the label parameter.

A vulnerability allowing XSS in Foreman 1.7.0 and higher was reported from upstream. It is allowed to store the key/value parameters globally or assigned to various objects and using a tickbox in the UI the values can be hidden to mask them from casual viewing. The tickbox that hides/shows the value fails to handle HTML properly and so is vulnerable to an XSS issue where HTML can be stored in a parameter, and executed by another user if they later tick the hide/show box.

Upstream bug:

http://projects.theforeman.org/issues/11859

A stored cross-site scripting (XSS) flaw was found in the way input was escaped in the "Device Identifier" field when creating a new host in the Satellite web UI.