CVE-2014-3491

EUVD-2014-3496
Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Affected Products (NVD)
VendorProductVersion
theforemanforeman
𝑥
≤ 1.4.4
theforemanforeman
1.4.0
theforemanforeman
1.4.1
theforemanforeman
1.4.2
theforemanforeman
1.4.3
theforemanforeman
1.5.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://projects.theforeman.org/issues/5881
http://projects.theforeman.org/issues/5881