CVE-2016-8639

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-01 · updated 2026-06-17
Weakness: CWE-79

Description

It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.

Affected products

Red Hat Satellite 6: 6.3
RedHat Satellite Capsule: 6.3
foreman: before 1.13.0 — fixed in 1.13.0

How to fix

Upgrade to a fixed version: foreman 1.13.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/94263
https://access.redhat.com/errata/RHSA-2018:0336
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8639
https://github.com/theforeman/foreman/pull/3523
https://projects.theforeman.org/issues/15037
http://www.securityfocus.com/bid/94263
https://access.redhat.com/errata/RHSA-2018:0336
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8639
https://github.com/theforeman/foreman/pull/3523
https://projects.theforeman.org/issues/15037

Get alerted when CVE-2016-8639 or the next vulnerability affects your stack