Bug 1364025

Summary:	Reflective XSS in Smart Variables
Product:	Red Hat Satellite	Reporter:	Sanket Jagtap <sjagtap>
Component:	Security	Assignee:	Tomer Brisker <tbrisker>
Status:	CLOSED ERRATA	QA Contact:	Sanket Jagtap <sjagtap>
Severity:	medium	Docs Contact:
Priority:	high
Version:	6.2.0	CC:	akasurde, bbuckingham, bkearney, ehelms, kbidarka, lzap, mvanderw, tbrisker
Target Milestone:	Unspecified	Keywords:	Security, Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-02-21 17:10:17 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 3 Tomer Brisker 2016-08-07 13:38:29 UTC

Reducing severity as this is only reflected if the user inputs html in either the default value or the validator, and there is a validation error preventing it from being saved.

Comment 4 Tomer Brisker 2016-08-09 09:37:45 UTC

Created redmine issue http://projects.theforeman.org/issues/16020 from this bug

Comment 6 Bryan Kearney 2016-08-11 08:17:19 UTC

Moving to POST since upstream bug http://projects.theforeman.org/issues/16020 has been closed

Comment 10 Bryan Kearney 2018-02-21 17:10:17 UTC

Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA.

For information on the advisory, and where to find the updated files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:0336