Description
Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | foreman-proxy | 1.6.0.30-1.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | mongodb +2 | 2.4.6-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | python-anyjson | 0.3.3-4.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | python-httplib2 | 0.6.0-6.el7sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | python-simplejson | 3.2.0-1.el7sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | rubygem-kafo | 0.6.4-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | rubygem-kafo_parsers | 0.0.3-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | v8 | 1:3.14.5.10-9.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | foreman +6 | 1.6.0.44-1.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | foreman-proxy | 1.6.0.30-1.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | katello | 1.5.0-30.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | mongodb +2 | 2.4.6-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | python-anyjson | 0.3.3-4.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | python-httplib2 | 0.6.0-6.el7sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | python-simplejson | 3.2.0-1.el7sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-hammer_cli_foreman | 0.1.1-16.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-hammer_cli_foreman_tasks | 0.0.3-3.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-kafo | 0.6.4-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-kafo_parsers | 0.0.3-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | v8 | 1:3.14.5.10-9.el6sat | RHEA-2014:1175 |
Advisories 1
- RHEA-2014:1175 Red Hat Enhancement Advisory: Release of Satellite 6.0 Red Hat Security Advisories (RHSA) · Oct 7, 2026