Description
Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ManageIQ EVM | ManageIQ EVM | — | — |
| Red Hat | Red Hat CloudForms 3.0 | Red Hat CloudForms 3.0 Management Engine 5.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | cfme +3 | 5.2.2.3-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-ruby +4 | 1.9.3.448-40.1.el6 | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-actionpack | 1:3.2.13-5.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-amq-protocol +1 | 1.9.2-3.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-bigdecimal | 1.1.0-40.1.el6 | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-bunny +1 | 1.0.7-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-excon | 0.31.0-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-fog | 1.19.0-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-io-console | 0.3-40.1.el6 | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-linux_admin | 0.7.0-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-more_core_extensions | 1.1.2-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-nokogiri | 1.5.6-3.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygems +1 | 1.8.23-40.1.el6 | RHSA-2014:0215 |
Advisories 1
- RHSA-2014:0215 Red Hat Security Advisory: cfme security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026