Unscored severity · published Dec 17, 2015
CVE-2015-7518
Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit forms.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Foreman · Theforeman
through 1.9.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7518
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7518
projects.theforeman.org
http://projects.theforeman.org/issues/12611
Vendor Advisory
http://theforeman.org/security.html#2015-7518
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/12/09/6
access.redhat.com
https://access.redhat.com/errata/RHSA-2016:0174
More from Foreman
9.8
CVE-2018-14643
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman
9.1
CVE-2026-96659
Foreman: excessive permissions for viewer role on preview
9.1
CVE-2022-3874
A command injection flaw was found in foreman
9.1
CVE-2023-0462
An arbitrary code execution flaw was found in Foreman
9.1
CVE-2023-0118
An arbitrary code execution flaw was found in Foreman