Bug 1071741 (CVE-2014-0089)

Summary:	CVE-2014-0089 Foreman: Stored Cross Site Scripting
Product:	[Other] Security Response	Reporter:	Garth Mollett <gmollett>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bkearney, cpelland, jrusnack, mmccune, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-02-04 23:21:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1071761
Bug Blocks:	1076333

Description Garth Mollett 2014-03-03 05:37:22 UTC

Jeremy Choi and Keqin Hong of the Red Hat HSS Pen-Test Team reported a stored XSS issue in foreman. Authenticated users who are able to add bookmarks may inject malicious javascript or html that will be executed by other users viewing the page.

Comment 2 Garth Mollett 2014-03-04 03:58:37 UTC

Acknowledgements:

This issue was discovered by Jeremy Choi and Keqin Hong of the Red Hat HSS Pen-Test Team.

Comment 3 Garth Mollett 2014-03-04 04:05:37 UTC

Statement:

Not vulnerable. This issue did not affect the versions of foreman as shipped with Red Hat Enterprise Linux OpenStack Platform 3 or 4.