CVE-2016-6319 — Cross-site Scripting in Foreman

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.7%
top 27.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Theforeman Foreman
Timeline
PublishedAug 19
Latest updateMay 14

Description

Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via the label parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDtheforeman/foreman1.12.1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-63pc-xj3r-v6f8: Cross-site scripting (XSS) vulnerability in app/helpers/form_helper↗2022-05-14
▶
CVEList
CVE-2016-6319: Cross-site scripting (XSS) vulnerability in app/helpers/form_helper↗2016-08-19
▶

📋Vendor Advisories

1
Red Hat
foreman: Persistent XSS in Foreman remote execution plugin↗2016-08-09
▶

💬Community

1
Bugzilla
CVE-2016-6319 foreman: Persistent XSS in Foreman remote execution plugin↗2016-08-10
▶
CVE-2016-6319 — Cross-site Scripting in Foreman | cvebase