CVE-2017-7535 in Foreman

Résumé

par MITRE

foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Réserver: 05/04/2017
• Divulgation: 26/07/2018
• Modérer: accepté
• Entrée: VDB-122207
• CPE: prêt
• CWE: CWE-79 (confirmé)
• CVSS: 6.1 (NVD)
• EPSS: 0.00510
• KEV: non
• Activités: très faible
• Secteur: Energy, Pharma, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2017-7535
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-7535
• CVE Details: https://www.cvedetails.com/cve/CVE-2017-7535/