Project

General

Profile

Bug #20963

CVE-2017-7535: stored XSS in the manage organization page

Added by Tomer Brisker about 1 year ago. Updated 5 months ago.

Status:
Closed
Priority:
Low
Assignee:
Category:
Security
Target version:
Difficulty:
Triaged:
Bugzilla link:
Team Backlog:
Fixed in Releases:
Found in Releases:

Description

Attempting to assign all hosts to an organization or location that contains HTML does not properly escape the html in the toast notification informing of success.
Setting priority to low since exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action.

Associated revisions

Revision b8db2f93 (diff)
Added by Tomer Brisker about 1 year ago

Fixes #20963 - CVE-2017-7535 prevent XSS on org/loc host assign

Revision 08aea206 (diff)
Added by Tomer Brisker about 1 year ago

Fixes #20963 - CVE-2017-7535 prevent XSS on org/loc host assign

(cherry picked from commit b8db2f931208992d6bcff44a2d20101637f6c232)

History

#1 Updated by The Foreman Bot about 1 year ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/4851 added

#2 Updated by Daniel Lobato Garcia about 1 year ago

  • Legacy Backlogs Release (now unused) set to 240

#3 Updated by Anonymous about 1 year ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100

Also available in: Atom PDF