Question 1

What is CVE-2014-3492?

Accepted Answer

CVE-2014-3492 is a medium-severity software vulnerability (Cross-site scripting (XSS)) with a CVSS score of 4.3. Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter (1) name or (2) value related to the host

Question 2

Is CVE-2014-3492 being actively exploited?

Accepted Answer

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 1%.

Question 3

What products does CVE-2014-3492 affect?

Accepted Answer

Tracked products affected include Foreman. Check the version you run to see whether it is affected.

Question 4

How do I fix CVE-2014-3492?

Accepted Answer

Apply the vendor fix in your normal patch cycle. An official patch or advisory is available. Upgrade affected products to a fixed version.

CVE-2014-3492

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information