CVE-2014-3654

Red Hat Satellite 5.5-5.6 - Cross-Site Scripting via Multiple Endpoints

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.

References (5)

Core 5
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60976
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62027
Mailing List, Patch, Vendor Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.html
Mailing List, Patch, Vendor Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1762.html

Scores

EPSS 0.0030
EPSS Percentile 53.6%

Details

CWE
CWE-79
Status published
Products (6)
redhat/satellite 5.5
redhat/satellite 5.6
redhat/satellite_with_embedded_oracle 5.5
redhat/spacewalk-java 2.0.2
suse/manager 1.7
suse/manager_server
Published Nov 03, 2014
Tracked Since Feb 18, 2026