CVE-2017-15125

Related Files

Red Hat Security Advisory 2018-0380-01

Posted Mar 1, 2018

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-0380-01 - Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller framework for web application development. Action Pack implements the controller and the view components. Security Fix: A flaw was found in CloudForms in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP prevents exploitation of this XSS however not all browsers support CSP.

tags | advisory, web, javascript, ruby

systems | linux, redhat

advisories | CVE-2017-15125

SHA-256 | 8263e2b98dc7fbe588dd7a8bf6b2896046bc6f7af767bfddf08f4c424ddcf92e

Download | Favorite | View