Every CVE Search/ Get API key

CVE-2015-7518

Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10...

4.3 MediumFix available

Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit forms.

Exploit likelihood

1.85%Up 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit forms.

Record
CVE-2015-7518
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit forms.

Record
CVE-2015-7518
Updated
2026-11-02
EUVDEUVD-2015-7439 No score

Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit forms.

Record
EUVD-2015-7439
Updated
2026-11-03
GitHub AdvisoriesGHSA-cr73-cpqp-v63j No score

Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10...

Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit forms.

Record
GHSA-cr73-cpqp-v63j
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
capsule-installer
Red Hat:satellite_capsule:6.1::el6
 before 0:2.3.25-1.el6
0:2.3.25-1.el6
foreman
Red Hat:satellite_capsule:6.1::el6
 before 0:1.7.2.53-1.el6_6sat
0:1.7.2.53-1.el6_6sat
foreman-debug
Red Hat:satellite_capsule:6.1::el6
 before 0:1.7.2.53-1.el6_6sat
0:1.7.2.53-1.el6_6sat
katello-installer-base
Red Hat:satellite_capsule:6.1::el6
 before 0:2.3.25-1.el6
0:2.3.25-1.el6
pulp
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-admin-client
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-nodes-child
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-nodes-common
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-nodes-parent
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-puppet
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
Show 116 moreShow less
Affected packages
PackageAffectedFixed
pulp-puppet-admin-extensions
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-puppet-plugins
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-rpm
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-rpm-admin-extensions
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-rpm-handlers
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-rpm-plugins
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-selinux
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-server
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-kombu
Red Hat:satellite_capsule:6.1::el6
 before 1:3.0.24-11.pulp.el6
1:3.0.24-11.pulp.el6
python-pulp-agent-lib
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-pulp-bindings
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-pulp-client-lib
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-pulp-common
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-pulp-puppet-common
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-pulp-rpm-common
Red Hat:satellite_capsule:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
candlepin
Red Hat:satellite:6.1::el6
 before 0:0.9.49.11-1.el6
0:0.9.49.11-1.el6
candlepin-selinux
Red Hat:satellite:6.1::el6
 before 0:0.9.49.11-1.el6
0:0.9.49.11-1.el6
candlepin-tomcat6
Red Hat:satellite:6.1::el6
 before 0:0.9.49.11-1.el6
0:0.9.49.11-1.el6
foreman
Red Hat:satellite:6.1::el6
 before 0:1.7.2.53-1.el6_6sat
0:1.7.2.53-1.el6_6sat
foreman-compute
Red Hat:satellite:6.1::el6
 before 0:1.7.2.53-1.el6_6sat
0:1.7.2.53-1.el6_6sat
foreman-debug
Red Hat:satellite:6.1::el6
 before 0:1.7.2.53-1.el6_6sat
0:1.7.2.53-1.el6_6sat
foreman-gce
Red Hat:satellite:6.1::el6
 before 0:1.7.2.53-1.el6_6sat
0:1.7.2.53-1.el6_6sat
foreman-libvirt
Red Hat:satellite:6.1::el6
 before 0:1.7.2.53-1.el6_6sat
0:1.7.2.53-1.el6_6sat
foreman-ovirt
Red Hat:satellite:6.1::el6
 before 0:1.7.2.53-1.el6_6sat
0:1.7.2.53-1.el6_6sat
foreman-postgresql
Red Hat:satellite:6.1::el6
 before 0:1.7.2.53-1.el6_6sat
0:1.7.2.53-1.el6_6sat
foreman-vmware
Red Hat:satellite:6.1::el6
 before 0:1.7.2.53-1.el6_6sat
0:1.7.2.53-1.el6_6sat
katello-installer
Red Hat:satellite:6.1::el6
 before 0:2.3.25-1.el6
0:2.3.25-1.el6
katello-installer-base
Red Hat:satellite:6.1::el6
 before 0:2.3.25-1.el6
0:2.3.25-1.el6
pulp
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-admin-client
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-nodes-child
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-nodes-common
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-nodes-parent
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-puppet
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-puppet-admin-extensions
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-puppet-plugins
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-puppet-tools
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-rpm
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-rpm-admin-extensions
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-rpm-handlers
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-rpm-plugins
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-selinux
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
pulp-server
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-kombu
Red Hat:satellite:6.1::el6
 before 1:3.0.24-11.pulp.el6
1:3.0.24-11.pulp.el6
python-pulp-agent-lib
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-pulp-bindings
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-pulp-client-lib
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-pulp-common
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-pulp-puppet-common
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
python-pulp-rpm-common
Red Hat:satellite:6.1::el6
 before 0:2.6.0.20-1.el6
0:2.6.0.20-1.el6
ruby193-rubygem-fog
Red Hat:satellite:6.1::el6
 before 0:1.24.1-1.el6_6sat
0:1.24.1-1.el6_6sat
ruby193-rubygem-katello
Red Hat:satellite:6.1::el6
 before 0:2.2.0.83-1.el6_6sat
0:2.2.0.83-1.el6_6sat
rubygem-hammer_cli_katello
Red Hat:satellite:6.1::el6
 before 0:0.0.7.21-1.el6
0:0.0.7.21-1.el6
capsule-installer
Red Hat:satellite_capsule:6.1::el7
 before 0:2.3.25-1.el7sat
0:2.3.25-1.el7sat
foreman
Red Hat:satellite_capsule:6.1::el7
 before 0:1.7.2.53-1.el7sat
0:1.7.2.53-1.el7sat
foreman-debug
Red Hat:satellite_capsule:6.1::el7
 before 0:1.7.2.53-1.el7sat
0:1.7.2.53-1.el7sat
katello-installer-base
Red Hat:satellite_capsule:6.1::el7
 before 0:2.3.25-1.el7sat
0:2.3.25-1.el7sat
pulp
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-admin-client
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-nodes-child
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-nodes-common
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-nodes-parent
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-puppet
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-puppet-admin-extensions
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-puppet-plugins
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-rpm
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-rpm-admin-extensions
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-rpm-handlers
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-rpm-plugins
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-selinux
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-server
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-kombu
Red Hat:satellite_capsule:6.1::el7
 before 1:3.0.24-11.pulp.el7sat
1:3.0.24-11.pulp.el7sat
python-pulp-agent-lib
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-pulp-bindings
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-pulp-client-lib
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-pulp-common
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-pulp-puppet-common
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-pulp-rpm-common
Red Hat:satellite_capsule:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
candlepin
Red Hat:satellite:6.1::el7
 before 0:0.9.49.11-1.el7
0:0.9.49.11-1.el7
candlepin-selinux
Red Hat:satellite:6.1::el7
 before 0:0.9.49.11-1.el7
0:0.9.49.11-1.el7
candlepin-tomcat
Red Hat:satellite:6.1::el7
 before 0:0.9.49.11-1.el7
0:0.9.49.11-1.el7
foreman
Red Hat:satellite:6.1::el7
 before 0:1.7.2.53-1.el7sat
0:1.7.2.53-1.el7sat
foreman-compute
Red Hat:satellite:6.1::el7
 before 0:1.7.2.53-1.el7sat
0:1.7.2.53-1.el7sat
foreman-debug
Red Hat:satellite:6.1::el7
 before 0:1.7.2.53-1.el7sat
0:1.7.2.53-1.el7sat
foreman-gce
Red Hat:satellite:6.1::el7
 before 0:1.7.2.53-1.el7sat
0:1.7.2.53-1.el7sat
foreman-libvirt
Red Hat:satellite:6.1::el7
 before 0:1.7.2.53-1.el7sat
0:1.7.2.53-1.el7sat
foreman-ovirt
Red Hat:satellite:6.1::el7
 before 0:1.7.2.53-1.el7sat
0:1.7.2.53-1.el7sat
foreman-postgresql
Red Hat:satellite:6.1::el7
 before 0:1.7.2.53-1.el7sat
0:1.7.2.53-1.el7sat
foreman-vmware
Red Hat:satellite:6.1::el7
 before 0:1.7.2.53-1.el7sat
0:1.7.2.53-1.el7sat
katello-installer
Red Hat:satellite:6.1::el7
 before 0:2.3.25-1.el7sat
0:2.3.25-1.el7sat
katello-installer-base
Red Hat:satellite:6.1::el7
 before 0:2.3.25-1.el7sat
0:2.3.25-1.el7sat
pulp
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-admin-client
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-nodes-child
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-nodes-common
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-nodes-parent
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-puppet
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-puppet-admin-extensions
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-puppet-plugins
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-puppet-tools
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-rpm
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-rpm-admin-extensions
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-rpm-handlers
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-rpm-plugins
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-selinux
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
pulp-server
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-kombu
Red Hat:satellite:6.1::el7
 before 1:3.0.24-11.pulp.el7sat
1:3.0.24-11.pulp.el7sat
python-pulp-agent-lib
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-pulp-bindings
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-pulp-client-lib
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-pulp-common
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-pulp-puppet-common
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
python-pulp-rpm-common
Red Hat:satellite:6.1::el7
 before 0:2.6.0.20-1.el7sat
0:2.6.0.20-1.el7sat
ruby193-rubygem-fog
Red Hat:satellite:6.1::el7
 before 0:1.24.1-1.el7sat
0:1.24.1-1.el7sat
ruby193-rubygem-katello
Red Hat:satellite:6.1::el7
 before 0:2.2.0.83-1.el7sat
0:2.2.0.83-1.el7sat
rubygem-hammer_cli_katello
Red Hat:satellite:6.1::el7
 before 0:0.0.7.21-1.el7sat
0:0.0.7.21-1.el7sat

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-7518 is a medium vulnerability (CVSS 4.3) in Theforeman Foreman, published December 17, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in capsule-installer 0:2.3.25-1.el6.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open