Marek Hulán of Red Hat reports: User can define a job template and specify input name containing JS code. When someone tries to invoke such job, the form is generated based on this name without proper escaping so the JS gets executed. Upstream issue: http://projects.theforeman.org/issues/16019 Proposed upstream patch: https://github.com/theforeman/foreman/pull/3715/commits/4b63d2c7cdad76ed2bf96d9f8dff7e0c5cdabda6
Acknowledgments: Name: Marek Hulán (Red Hat)
This issue has been addressed in the following products: Red Hat Satellite 6.3 for RHEL 7 Via RHSA-2018:0336 https://access.redhat.com/errata/RHSA-2018:0336