CVE-2017-15125: A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field...

Security readout for executives and security teams

CVE-2017-15125 is a stored cross-site scripting issue in Red Hat CloudForms self-service snapshot naming. A logged-in attacker could save HTML or JavaScript that later runs when an application administrator views it. Red Hat notes Content Security Policy can prevent exploitation, but browser support is not universal. Exposure is most likely in organizations running Red Hat CloudForms versions covered by the advisory, especially where self-service snapshot creation is available to non-admin users. Treat this as a moderate-priority remediation item for CloudForms environments. It requires authenticated access and administrator interaction, but stored XSS against administrators can support account misuse or operational disruption if left unpatched. Mitigation focus: Apply Red Hat guidance in RHSA-2018:0380 for affected CloudForms deployments.; Confirm CloudForms is updated beyond the vulnerable release line described by Red Hat.; Keep Content Security Policy enabled, but do not rely on CSP as the only control..

Prepared

May 24, 2026, 20:29 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.