CVE-2014-3595 Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web sc...
MediumCVSS 4.3
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat satellite | = 5.4 | No fix listed |
| redhat satellite | = 5.5 | No fix listed |
| redhat satellite | = 5.6 | No fix listed |
| redhat satellite with embedded oracle | = 5.4 | No fix listed |
| redhat satellite with embedded oracle | = 5.5 | No fix listed |
| redhat spacewalk-java | = 1.2.39 | No fix listed |
| redhat spacewalk-java | = 1.7.54 | No fix listed |
| redhat spacewalk-java | = 2.0.2 | No fix listed |
| SUSE manager | = 1.7 | No fix listed |
| SUSE manager server | All versions | No fix listed |
References
- SUSE-SU-2014:1218 mailing-list patch vendor-advisory
- SUSE-SU-2014:1339 mailing-list patch vendor-advisory
- RHSA-2014:1184 vendor-advisory
- 61115 third-party-advisory
- 62027 third-party-advisory