CVE-2017-7535: foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts.

Security readout for executives and security teams

Foreman versions before 1.16.0 can store unsafe HTML in organization or location names and later show it during host assignment. A user who views that workflow could have script content run in their browser. This is most concerning for organizations using Foreman as an internal infrastructure management interface. Exposure is likely limited to Foreman deployments running versions before 1.16.0 and using organization or location assignment workflows for hosts. Internet exposure increases business risk, but the provided sources do not specify deployment prevalence or default exposure. Treat this as a moderate-priority maintenance and hygiene issue, especially if Foreman is broadly accessible or used by privileged infrastructure staff. It is not presented as actively exploited in the provided evidence, but stored XSS in an admin workflow can still support account or session abuse. Mitigation focus: Upgrade Foreman to 1.16.0 or later where vendor packaging confirms the fix.; Review vendor advisories and downstream package notes before maintenance rollout.; Restrict who can create or rename organizations and locations..

Prepared

May 25, 2026, 04:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.