{"id":"CVE-2016-8613","url":"https://www.cyber-defence.io/tools/cve/CVE-2016-8613","generatedAt":"2026-10-29T00:46:34.637Z","title":"The remote execution plugin runs commands on hosts over SSH from the Foreman web UI.","description":"A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.","published":"2018-07-31T20:29:00.000Z","lastModified":"2026-06-17T00:54:36.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.0","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["theforeman/foreman"],"epss":{"score":0.02396,"percentile":0.83916,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (2.40%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/93859","tags":["Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8613","tags":["Issue Tracking","Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://github.com/theforeman/foreman_remote_execution/pull/208","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://projects.theforeman.org/issues/17066/","tags":["Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/93859","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8613","tags":["Issue Tracking","Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/theforeman/foreman_remote_execution/pull/208","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://projects.theforeman.org/issues/17066/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-8613","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}