Bug #21519
CVE-2017-15100: Stored XSS in fact name or value
Difficulty:
Triaged:
Bugzilla link:
Pull request:
Description
Sending a fact name or value containing HTML can lead to a stored XSS in the following pages:
- Facts page - When opening a chart for a fact that has HTML in it's name or as one of the values.
- Trends page - A trend containing a value that includes HTML in it.
- Statistics page - Fact values that are aggregated on the page such as manufacturer and contain HTML.
This issue has been reported by Roman Mueller.
Related issues
Associated revisions
History
#1
Updated by Tomer Brisker over 5 years ago
Updated by - Legacy Backlogs Release (now unused) set to 240
Setting for 1.16 for now, will possibly do another 1.15 release if needed.
#2
Updated by Tomer Brisker over 5 years ago
- Description updated (diff)
#3
Updated by The Foreman Bot over 5 years ago
Updated by - Status changed from Assigned to Ready For Testing
- Pull request https://github.com/theforeman/foreman/pull/4967 added
#4
Updated by Tomer Brisker over 5 years ago
- Subject changed from Stored XSS in fact name or value to CVE-2017-15100: Stored XSS in fact name or value
#5
Updated by Anonymous over 5 years ago
- % Done changed from 0 to 100
- Status changed from Ready For Testing to Closed
Applied in changeset 81e40e3a14a90c11c4193bebc7eecb79c2cfb9b1.
#6
Updated by Bryan Kearney about 5 years ago
Updated by - Bugzilla link set to 1509442
#7
Updated by Marek Hulán over 4 years ago
Updated by - Related to Bug #24834: Fact names and values are not displayed properly added
Fixes #21519 - Prevent stored XSS on fact charts