CVE-2017-15125
Last modified
CVE-2017-15125 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. EPSS estimates a 0.93% chance of exploitation in the next 30 days.
Description
A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP (Content Security Policy) prevents exploitation of this XSS however not all browsers support CSP.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Cloudforms Management Engine | < 5.9.0.22 |
References
- https://www.securityfocus.com/bid/102287Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:0380Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15125Issue Tracking, Vendor Advisory
- https://www.securityfocus.com/bid/102287Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:0380Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15125Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-15125?
How severe is CVE-2017-15125?
How do I fix CVE-2017-15125?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-15119The Network Block Device (NBD) server in Quick Emulator (QEM…5.8
- CVE-2017-15120An issue has been found in the parsing of authoritative answ…7.5
- CVE-2017-15121A non-privileged user is able to mount a fuse filesystem on …
- CVE-2017-15122Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-15123A flaw was found in the CloudForms web interface, versions 5…5.3
- CVE-2017-15124VNC server implementation in Quick Emulator (QEMU) 2.11.0 an…
- CVE-2017-15126A use-after-free flaw was found in fs/userfaultfd.c in the L…8.1
- CVE-2017-15127A flaw was found in the hugetlb_mcopy_atomic_pte function in…
- CVE-2017-15128A flaw was found in the hugetlb_mcopy_atomic_pte function in…
- CVE-2017-15129A use-after-free vulnerability was found in network namespac…4.7
- CVE-2017-15130A denial of service flaw was found in dovecot before 2.2.34.…
- CVE-2017-15131It was found that system umask policy is not being honored w…
Are you affected by CVE-2017-15125?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST