GCVE - cpe:2.3:a:theforeman:foreman:1.14.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:theforeman:foreman:1.14.0:*:*:*:*:*:*:*

part: a version: 1.14.0 update: *

Vendor	Theforeman (`760bf134-312a-50ab-8452-1d7485d10f9b`)
Product	Foreman (`a88a3ac5-9a3c-5a4c-91ec-c5eca465eab6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/ruby-foreman`	purl2cpe	2026-06-01 10:15:04.573496
`pkg:deb/ubuntu/ruby-foreman`	purl2cpe	2026-06-01 10:15:04.573497
`pkg:gem/foreman`	purl2cpe	2026-06-01 10:15:04.573499
`pkg:github/theforeman/foreman`	purl2cpe	2026-06-01 10:15:04.573501
`pkg:rpm/opensuse/rubygem-foreman`	purl2cpe	2026-06-01 10:15:04.573502

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7505`	vulnerable	2026-06-08 05:09:56.275812	Details available Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords. Published: 2017-05-26T16:00:00.000Z Updated: 2024-08-05T16:04:11.828Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/98607 http://projects.theforeman.org/issues/19612 https://github.com/theforeman/foreman/pull/4545	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-8634`	vulnerable	2026-06-08 05:08:14.513021	Details available MEDIUM (6.1) A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL. Published: 2018-08-01T12:00:00.000Z Updated: 2024-08-06T02:27:41.211Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/94206 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8634 https://projects.theforeman.org/issues/17195	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5282`	vulnerable	2026-06-08 05:06:49.439892	Details available Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after. Published: 2017-09-25T17:00:00.000Z Updated: 2024-08-06T06:41:09.516Z Open on db.gcve.eu Reference links https://github.com/theforeman/foreman/commit/4f3555b217be8723e8045f9816d147b5f684ec57 https://bugzilla.redhat.com/show_bug.cgi?id=1264221 http://www.openwall.com/lists/oss-security/2015/09/21/3 https://theforeman.org/security.html#2015-5282 http://projects.theforeman.org/issues/11859	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.