A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2018-08-01T12:00:00

Updated: 2024-08-06T02:27:41.211Z

Reserved: 2016-10-12T00:00:00

Link: CVE-2016-8634

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-08-01T12:29:00.413

Modified: 2023-02-12T23:26:13.993

Link: CVE-2016-8634

cve-icon Redhat

Severity : Moderate

Publid Date: 2016-11-03T00:00:00Z

Links: CVE-2016-8634 - Bugzilla