CVE-2014-3595
Red Hat Satellite 5.4-5.6 - Cross-Site Scripting in Logging
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.
References (5)
Core 5
Core References
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/62027
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1184.html
Mailing List, Patch, Vendor Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00031.html
Mailing List, Patch, Vendor Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/61115
Scores
EPSS
0.0037
EPSS Percentile
59.2%
Details
CWE
CWE-79
Status
published
Products (10)
redhat/satellite
5.4
redhat/satellite
5.5
redhat/satellite
5.6
redhat/satellite_with_embedded_oracle
5.4
redhat/satellite_with_embedded_oracle
5.5
redhat/spacewalk-java
1.2.39
redhat/spacewalk-java
1.7.54
redhat/spacewalk-java
2.0.2
suse/manager
1.7
suse/manager_server
Published
Sep 22, 2014
Tracked Since
Feb 18, 2026