Cross-Site Scripting Flaw in CloudForms by Red Hat
CVE-2017-15125

6.5MEDIUM

Key Information:

Vendor
Red Hat
Status
Cloudforms
Vendor
CVE Published:
27 July 2018

Summary

A security flaw exists in the CloudForms self-service UI where the name field does not adequately sanitize HTML and JavaScript inputs. This may allow an attacker to execute a stored cross-site scripting attack on an application administrator. Although implementing Content Security Policy (CSP) can help mitigate this issue, it is important to note that not all browsers offer support for CSP, leaving some users potentially vulnerable.

Affected Version(s)

cloudforms 5.9.0.22

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15125
x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:0380
vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/102287
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.