CVE-2016-8613 MEDIUM

CVE-2016-8613

Vendor The Foreman Project
Product foreman
Weakness CWE-79 · XSS
Published July 31, 2018
Last update August 6, 2024
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.

Key dates

02Disclosure timeline

July 31, 2018 CVE published
August 6, 2024 Record updated