Satellite: xss in custom system information key handling (Red Hat Red Hat Network Satellite Server v 5.4)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.24 % · percentile 69 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
- http://secunia.com/advisories/47162
- http://www.redhat.com/support/errata/RHSA-2011-1794.html
- http://www.securityfocus.com/bid/50963
- http://www.securitytracker.com/id?1026391
- https://access.redhat.com/errata/RHSA-2011:1794
- https://access.redhat.com/security/cve/CVE-2011-4346
- https://bugzilla.redhat.com/show_bug.cgi?id=742050
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | redhat |
| CVSS 3.1 | MEDIUM 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | NVD · secalert@redhat.com (Primary) |
| CVSS 2.0 | LOW 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2011-4277
- GCVE · GCVE-0-2011-4346
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:satellite:5.4.1:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Red Hat · Red Hat Network Satellite Server v 5.4 | unaffected 0:1.2.7-21.el5sat < * |
| Red Hat · Red Hat Satellite 6 | |
| Red Hat · Red Hat Satellite 6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |