Description
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | cloudforms | cloudforms 5.8 and cloudforms 5.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | ansible-tower +5 | 3.5.2-1.el7at | RHSA-2019:2587 |
| Red Hat CloudForms 5 | cfme +5 | 5.10.9.1-1.el7cf | RHSA-2019:2587 |
| Red Hat CloudForms 5 | ovirt-ansible-hosted-engine-setup | 1.0.23-1.el7ev | RHSA-2019:2587 |
| Red Hat CloudForms 5 | ovirt-ansible-roles | 1.1.7-1.el7ev | RHSA-2019:2587 |
| Red Hat CloudForms 5 | ovirt-ansible-vm-infra | 1.1.19-1.el7ev | RHSA-2019:2587 |
| Red Hat CloudForms 5 | v2v-conversion-host +2 | 1.14.2-1.el7ev | RHSA-2019:2587 |
Advisories 1
- RHSA-2019:2587 Red Hat Security Advisory: CloudForms 4.7.9 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026