PT-2014-2131 · Red Hat · Spacewalk

CVE-2011-2920 · Publicado 2014-02-05 · Atualizado 2023-02-13

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Spacewalk version 1.6

Description The issue allows remote attackers to inject arbitrary web script or HTML via the "Filter by Synopsis" field and other unspecified filter forms, potentially leading to cross-site scripting (XSS) attacks.

Recommendations For Spacewalk version 1.6, consider restricting access to the "Filter by Synopsis" field and other vulnerable filter forms until a patch is available. As a temporary workaround, avoid using the vulnerable filter forms to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-2920

RHSA-2011:1299

Produtos afetados

Spacewalk

Referências · 6

• https://t.me/cvenotify/43444 · Publicação no Telegram
• https://redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2011-2920 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=681032 · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2011-1299.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-2920 · Nota de Segurança