CVE-2015-0284

MEDIUM

Redhat Satellite - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.

References (7)

[Vendor Advisory] http://rhn.redhat.com/errata/RHSA-2016-0590.html

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=1181152

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=1181472

[Patch] https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744

[Patch] https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=1314906

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=1315398

Scores

CVSS v3 5.4

EPSS 0.0027

EPSS Percentile 50.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status draft

Affected Products (2)

redhat/satellite

redhat/spacewalk-java

Timeline

Published Apr 14, 2016

Tracked Since Feb 18, 2026