Cross-site scripting in Red Hat cloudforms
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.
Summary
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.
Why it matters now
EPSS 0.00608 49th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | cloudforms | cloudforms 5.8 and cloudforms 5.9 | — | No fix listed | CNA |
- cloudforms VendorRed Hat Affected cloudforms 5.8 and cloudforms 5.9 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:cloudforms_management_engine:4.7:*:*:*:*:*:*:* | 4.7 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:cloudforms_management_engine:5.8:*:*:*:*:*:*:* | 5.8 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:cloudforms_management_engine:5.9:*:*:*:*:*:*:* | 5.9 | Vulnerable | Red Hat |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
- cpe:2.3:a:redhat:cloudforms_management_engine:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:cloudforms_management_engine:5.8:*:*:*:*:*:*:* Versions 5.8 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:cloudforms_management_engine:5.9:*:*:*:*:*:*:* Versions 5.9 Vulnerable ·Red Hat
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
Remediation
Red Hat 1 advisory
- RHSA-2019:2587 Released 2019-09-05 · Red Hat rating ModerateCloudForms 4.7.9 security, bug fix and enhancement update
- CloudForms Management Engine 5.10 ansible-tower-3.5.2-1.el7at, ansible-tower-server-3.5.2-1.el7at, ansible-tower-setup-3.5.2-1.el7at +15
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms Management Engine 5.10 | Fixed | RHSA-2019:2587 |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-10854
- 2026-10-03 Alias added: GHSA-wqjf-hq52-vg86
References
More Red Hat Cloudforms Management Engine vulnerabilities
- TI-2013-01839 Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms… CVSS 2.0HIGH 9.4
- TI-2013-01821 SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0… CVSS 2.0HIGH 7.5
- TI-2016-04680 Code injection in [UNKNOWN] cfme CVSS 3.0HIGH 8.8
- TI-2020-11195 OS command injection in CloudForms CVSS 3.1CRITICAL 9.1
- TI-2019-11098 Improper input validation in [UNKNOWN] CloudForms CVSS 3.1HIGH 8.0
- TI-2016-06078 Improper authorization in Red Hat CFME CVSS 3.0HIGH 8.8
Sources
- CVE-2018-10854 · CVE Program
- CVE-2018-10854 · NVD
- FIRST EPSS
- GHSA-wqjf-hq52-vg86 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-10854 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences