Satellite: xss in custom system information key handling (Red Hat Red Hat Network Satellite Server v 5.4)
En bref
- Source
- NVD
- EPSS
- EPSS 1.24 % · centile 69 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
- http://secunia.com/advisories/47162
- http://www.redhat.com/support/errata/RHSA-2011-1794.html
- http://www.securityfocus.com/bid/50963
- http://www.securitytracker.com/id?1026391
- https://access.redhat.com/errata/RHSA-2011:1794
- https://access.redhat.com/security/cve/CVE-2011-4346
- https://bugzilla.redhat.com/show_bug.cgi?id=742050
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | redhat |
| CVSS 3.1 | MEDIUM 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | NVD · secalert@redhat.com (Primary) |
| CVSS 2.0 | LOW 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2011-4277
- GCVE · GCVE-0-2011-4346
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:satellite:5.4.1:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Red Hat · Red Hat Network Satellite Server v 5.4 | unaffected 0:1.2.7-21.el5sat < * |
| Red Hat · Red Hat Satellite 6 | |
| Red Hat · Red Hat Satellite 6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |