[<prev] [next>] [day] [month] [year] [list]
Message-ID: <e83aa49b-8c7d-e662-55bd-8f5a415e38b8@cleal.org>
Date: Wed, 9 Nov 2016 13:28:53 +0000
From: Dominic Cleal <dominic@...al.org>
To: oss-security@...ts.openwall.com
Cc: foreman-security@...glegroups.com
Subject: CVE-2016-8634: Foreman stored XSS in orgs/locations wizard step
CVE-2016-8634: Foreman organization/location wizard may run stored XSS
in name
When creating an organization or location in Foreman, if the name
contains HTML then the second step of the wizard will render the HTML.
This occurs in the alert box on the page.
This may permit a stored XSS attack if an organization/location with
HTML in the name is created, then a user is linked directly to this URL.
Mitigation: restrict permissions to organization and location creation,
don't follow untrusted links to Foreman.
This issue was reported by Sanket Jagtap.
Affects Foreman 1.1 and higher
Fix due to be released in Foreman 1.14.0
Patch:
https://github.com/theforeman/foreman/commit/5a573456b5ecb3ba0d24e057722704f9afeda8f7
More information:
https://theforeman.org/security.html#2016-8634
http://projects.theforeman.org/issues/17195
https://theforeman.org
--
Dominic Cleal
dominic@...al.org
Download attachment "signature.asc" of type "application/pgp-signature" (210 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
