CVE-2014-3654 Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML v...
MediumCVSS 4.3
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat satellite | = 5.5 | No fix listed |
| redhat satellite | = 5.6 | No fix listed |
| redhat satellite with embedded oracle | = 5.5 | No fix listed |
| redhat spacewalk-java | = 2.0.2 | No fix listed |
| SUSE manager server | All versions | No fix listed |
| SUSE manager | = 1.7 | No fix listed |
References
- SUSE-SU-2014:1339 mailing-list patch vendor-advisory
- SUSE-SU-2014:1342 mailing-list patch vendor-advisory
- RHSA-2014:1762 vendor-advisory
- 60976 third-party-advisory
- 62027 third-party-advisory