CVE-2017-7535 MEDIUM

CVE-2017-7535

Vendor Foreman
Product foreman
Weakness CWE-79 · XSS
Published July 26, 2018
Last update August 5, 2024

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action.

Key dates

02Disclosure timeline

July 26, 2018 CVE published
August 5, 2024 Record updated