CVE-2017-15125

N/A

A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP (Content Security Policy) prevents exploitation of this XSS however not all browsers support CSP.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Red Hat CloudForms 跨站脚本漏洞

Red Hat CloudForms是美国红帽（Red Hat）公司的一套IaaS（基础设施即服务）云服务解决方案。该方案可创建、管理私有和公共云，并具备对应用程序生命周期的管理能力。 Red Hat CloudForms 5.9.0.22之前版本中的self-service UI snapshot服务存在跨站脚本漏洞，该漏洞源于程序没有过滤用户提交的输入。远程攻击者可利用该漏洞在受影响浏览器中执行HTML和脚本代码。

N/A

N/A