CVE-2017-15100

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-27 · updated 2026-06-17
Weakness: CWE-79

Description

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.

Affected products

Red Hat Satellite 6: 6.4
RedHat Satellite Capsule: 6.4
foreman: before 1.16.0 — fixed in 1.16.0

How to fix

Upgrade to a fixed version: foreman 1.16.0. Check the vendor advisory for mitigations.

References

http://projects.theforeman.org/issues/21519
https://access.redhat.com/errata/RHSA-2018:2927
https://github.com/theforeman/foreman/pull/4967
http://projects.theforeman.org/issues/21519
https://access.redhat.com/errata/RHSA-2018:2927
https://github.com/theforeman/foreman/pull/4967

Get alerted when CVE-2017-15100 or the next vulnerability affects your stack