CVE-2017-15125: red hat cloudforms
Vulnerability summary
CVE-2017-15125 is a medium (CVSS 6.5) vulnerability in red hat cloudforms. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 60.8% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 27-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP (Content Security Policy) prevents exploitation of this XSS however not all browsers support CSP.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.93%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.93% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Red hat1 product
- cloudforms5.9.0.22
Redhat1 product
- cloudforms_management_engine< 5.9.0.22
2 vendors · 2 products