CVE Feed

    Dashboard / CVE / CVE-2017-15125

    CVE-2017-15125

    A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP (Content Security Policy) prevents exploitation of this XSS however not all browsers support CSP.

    Published:Dec 21, 2017
    Last Modified:Nov 21, 2024
    EPS:Jul 27, 2018
    EPSS Score:0.00246
    CVSS Score:6.5

    Affected Products

    Vendor
    Redhat
    Product
    Cloudforms Management Engine
    Vendor
    Redhat
    Product
    Cloudforms Managementengine

    Exploits

    No exploit reference

    Related CVEs

    CVE-2020-14324 (CVSS 9.1) — A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out …
    CVE-2020-14296 (CVSS 7.1) — Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add…
    CVE-2020-10780 (CVSS 6.3) — Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim …
    CVE-2019-14894 (CVSS 8) — A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, whic…
    CVE-2020-1739 (CVSS 3.9) — A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with…
    CVE-2020-1740 (CVSS 3.9) — A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes …
    CVE-2020-1736 (CVSS 2.2) — A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be…
    CVE-2020-1738 (CVSS 3.9) — A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not s…
    CVE-2020-1733 (CVSS 5) — A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when runn…
    CVE-2020-1735 (CVSS 4.2) — A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High