CoreCVE
Back

MEDIUM

foreman: Persisted XSS on all pages that use breadcrumbs

Published Oct 12, 2018

Description

A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (8)

Change history (6)
  1. MITRE
    • CVSS severity changed from HIGH to MEDIUM
    • CVSS vector changed from CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L to CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    • CVSS score changed from 7.6 to 5.4
  2. REDHAT
    • CVSS severity changed from MEDIUM to HIGH
    • CVSS vector changed from CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N to CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
    • CVSS score changed from 5.4 to 7.6
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Oct 12, 2018
Updated Aug 5, 2024
Reserved Jul 27, 2018
Link CVE-2018-14664
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-14664
Red Hat
Severity Moderate
Public date Oct 10, 2018
Links CVE-2018-14664 - Bugzilla