cloudforms: stored cross-site scripting in Name field
Published Nov 22, 2019
5.4
MEDIUMCVSS 3.1
EPSS 0.61%
Description
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.
Affected products
-
- Version cloudforms 5.8 and cloudforms 5.9StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Red Hat | Cloudforms | n/a |
|
- 4.7
- 5.8
- 5.9
Running on/with
- n/a
No data.
CloudForms Management Engine 5.10
ansible-tower-0:3.5.2-1.el7at
Fixed · RHSA-2019:2587
CloudForms Management Engine 5.10
cfme-0:5.10.9.1-1.el7cf
Fixed · RHSA-2019:2587
CloudForms Management Engine 5.10
cfme-amazon-smartstate-0:5.10.9.1-1.el7cf
Fixed · RHSA-2019:2587
CloudForms Management Engine 5.10
cfme-appliance-0:5.10.9.1-1.el7cf
Fixed · RHSA-2019:2587
CloudForms Management Engine 5.10
cfme-gemset-0:5.10.9.1-1.el7cf
Fixed · RHSA-2019:2587
CloudForms Management Engine 5.10
ovirt-ansible-hosted-engine-setup-0:1.0.23-1.el7ev
Fixed · RHSA-2019:2587
CloudForms Management Engine 5.10
ovirt-ansible-roles-0:1.1.7-1.el7ev
Fixed · RHSA-2019:2587
CloudForms Management Engine 5.10
ovirt-ansible-vm-infra-0:1.1.19-1.el7ev
Fixed · RHSA-2019:2587
CloudForms Management Engine 5.10
v2v-conversion-host-0:1.14.2-1.el7ev
Fixed · RHSA-2019:2587
| Product | Package | State | Advisory |
|---|---|---|---|
| CloudForms Management Engine 5.10 | ansible-tower-0:3.5.2-1.el7at | Fixed | RHSA-2019:2587 |
| CloudForms Management Engine 5.10 | cfme-0:5.10.9.1-1.el7cf | Fixed | RHSA-2019:2587 |
| CloudForms Management Engine 5.10 | cfme-amazon-smartstate-0:5.10.9.1-1.el7cf | Fixed | RHSA-2019:2587 |
| CloudForms Management Engine 5.10 | cfme-appliance-0:5.10.9.1-1.el7cf | Fixed | RHSA-2019:2587 |
| CloudForms Management Engine 5.10 | cfme-gemset-0:5.10.9.1-1.el7cf | Fixed | RHSA-2019:2587 |
| CloudForms Management Engine 5.10 | ovirt-ansible-hosted-engine-setup-0:1.0.23-1.el7ev | Fixed | RHSA-2019:2587 |
| CloudForms Management Engine 5.10 | ovirt-ansible-roles-0:1.1.7-1.el7ev | Fixed | RHSA-2019:2587 |
| CloudForms Management Engine 5.10 | ovirt-ansible-vm-infra-0:1.1.19-1.el7ev | Fixed | RHSA-2019:2587 |
| CloudForms Management Engine 5.10 | v2v-conversion-host-0:1.14.2-1.el7ev | Fixed | RHSA-2019:2587 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (6)
- https://access.redhat.com/security/cve/CVE-2018-10854 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1590538 Issue Tracking
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10854 x_refsource_CONFIRMIssue TrackingThird Party Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-2923 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-10854
- https://www.cve.org/CVERecord?id=CVE-2018-10854
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2018-10854 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1590538 | Issue Tracking | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10854 | x_refsource_CONFIRMIssue TrackingThird Party Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-2923 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2018-10854 | ||
| https://www.cve.org/CVERecord?id=CVE-2018-10854 |
Change history (0)
No recorded changes yet.