Bug 1108745 (CVE-2014-3531)

Summary: CVE-2014-3531 foreman: XSS with operating system name/description
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, aortega, apevec, athomas, ayoung, bkearney, chrisw, cpelland, dallan, dcleal, gkotton, gmollett, jrusnack, kseifried, lhh, markmc, mmccune, rbryant, sclewis, security-response-team, tjay, yeylon
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-05-20 05:18:40 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1106417, 1108753, 1119150    
Bug Blocks: 1108749    

Description Vasyl Kaigorodov 2014-06-12 13:58:09 UTC
It was found [1] that Red Hat Satellite 6 WebUI has a bug which allows an authenticated user to perform an XSS attack.

[1]: https://bugzilla.redhat.com/show_bug.cgi?id=1106417

Comment 2 Kurt Seifried 2014-07-11 07:46:29 UTC
This issue is now public:


Comment 3 Kurt Seifried 2015-05-20 05:18:40 UTC

This issue was fixed in current releases of foreman on Satellite 6.