CVE-2018-14664

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
[UNKNOWN]	foreman	n/a

References

http://www.securityfocus.com/bid/106553Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:1222
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14664Issue Tracking, Third Party Advisory
https://projects.theforeman.org/issues/25169Issue Tracking, Third Party Advisory
http://www.securityfocus.com/bid/106553Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:1222
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14664Issue Tracking, Third Party Advisory
https://projects.theforeman.org/issues/25169Issue Tracking, Third Party Advisory

Timeline

Published: Oct 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-146656.6A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X CVE-2018-146667.2An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host r CVE-2018-146679.8The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unaut CVE-2018-146688.8In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which CVE-2018-146697.5ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database CVE-2018-14677.5The IBM Storwize V7000 Unified management Web interface 1.6 exposes internal cluster details to unauthenticated users. IBM X-Force ID: 14039 CVE-2018-146709.8Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.CVE-2018-146719.8In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vu CVE-2018-146725.3In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messag CVE-2018-146787.8An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x8 CVE-2018-146796.5An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validi CVE-2018-14684.3IBM API Connect 5.0.8.1 and 5.0.8.2 could allow a user to get access to internal environment and sensitive API details to which they are not