CVE-2016-8634

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-01 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.

Affected products

foreman: 1.14.0

References

http://www.securityfocus.com/bid/94206
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8634
https://projects.theforeman.org/issues/17195
http://www.securityfocus.com/bid/94206
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8634
https://projects.theforeman.org/issues/17195

Get alerted when CVE-2016-8634 or the next vulnerability affects your stack