Homepage

Cross-site Scripting (XSS) The advisory has been revoked - it doesn't affect any version of package satellite:el8/foreman-installer  (opens in a new tab)

Threat Intelligence

EPSS
1.06% (60th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-SATELLITE-9889924
  • published28 Apr 2025
  • disclosed28 Feb 2024
Report a new vulnerability Found a mistake?

Introduced: 28 Feb 2024

CVE-2024-27285  (opens in a new tab)
CWE-79  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream satellite:el8/foreman-installer package and not the satellite:el8/foreman-installer package as distributed by RHEL.

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.