A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/93859 | Third Party Advisory VDB Entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8613 | Issue Tracking Patch Third Party Advisory |
| https://github.com/theforeman/foreman_remote_execution/pull/208 | Third Party Advisory |
| https://projects.theforeman.org/issues/17066/ | Vendor Advisory |
| http://www.securityfocus.com/bid/93859 | Third Party Advisory VDB Entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8613 | Issue Tracking Patch Third Party Advisory |
| https://github.com/theforeman/foreman_remote_execution/pull/208 | Third Party Advisory |
| https://projects.theforeman.org/issues/17066/ | Vendor Advisory |
Configurations
History
21 Nov 2024, 02:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/93859 - Third Party Advisory, VDB Entry | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8613 - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://github.com/theforeman/foreman_remote_execution/pull/208 - Third Party Advisory | |
| References | () https://projects.theforeman.org/issues/17066/ - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.4 |
Information
Published : 2018-07-31 20:29
Updated : 2024-11-21 02:59
NVD link : CVE-2016-8613
Mitre link : CVE-2016-8613
CVE.ORG link : CVE-2016-8613
JSON object : View
Products Affected
theforeman
- foreman
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')