Description
Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to an RPM info display.
References (5)
Core 5
Core References
Vendor Advisory x_refsource_confirm
http://support.novell.com/security/cve/CVE-2011-2644.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/49236
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/69279
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html
Issue Tracking x_refsource_confirm
https://bugzilla.novell.com/show_bug.cgi?id=700591
Scores
EPSS
0.0034
EPSS Percentile
57.1%
Details
CWE
CWE-79
Status
published
Products (2)
marcus_schafer/kiwi
< 3.74.1
novell/suse_studio_onsite
1.1
Published
Aug 23, 2011
Tracked Since
Feb 18, 2026