XSS in Theforeman Foreman

CVE-2014-3491

Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.015 (71.3th percentile) — read the EPSS interpretation.

Affected products

Theforeman Foreman — versions 1.4.0, 1.4.1, 1.4.2
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)