Red Hat Security Advisory

RHSA-2018:0380

Red Hat CloudForms security, bug fix, and enhancement update

Released 2018-03-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

CloudForms Management Engine 5.9 ansible-2.4.3.0-1.el7ae, ansible-doc-2.4.3.0-1.el7ae, ansible-tower-3.1.5-3.el7at +47

Fixes 2 records

TI-2017-11095 CVE-2017-15125 · GHSA-8ghx-pqhq-656w

Cross-site scripting in Red Hat cloudforms

LOW 31

A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input.

CVSS 3.0MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00934 Published 2018-07-27 Fixed CWE-79

TI-2013-03941 CVE-2013-4492 · GHSA-r5hc-9xx5-97rw

Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6…

LOW 24

Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02231 Published 2013-12-07 Partial fix · 0.6.6 CWE-79