Bug 1387232 (CVE-2016-8613) - CVE-2016-8613 foreman: Stored XSS vulnerability in remote execution plugin
Summary: CVE-2016-8613 foreman: Stored XSS vulnerability in remote execution plugin
Status: NEW
Alias: CVE-2016-8613
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Whiteboard: impact=moderate,public=20161024,repor...
Keywords: Security
Depends On: 1388202 1399326
Blocks: 1387235 1432306
TreeView+ depends on / blocked
Reported: 2016-10-20 12:14 UTC by Andrej Nemec
Modified: 2017-03-15 04:12 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

Description Andrej Nemec 2016-10-20 12:14:28 UTC
The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.

Comment 1 Andrej Nemec 2016-10-20 12:14:39 UTC

Name: Sanket Jagtap (Red Hat)

Comment 3 Ivan Necas 2016-10-24 18:03:10 UTC
The patch was accepted upstream, I've filed against Satellite product as https://bugzilla.redhat.com/show_bug.cgi?id=1388202 to match the issue

Note You need to log in before you can comment on or make changes to this bug.