PT-2014-2144 · Red Hat · Spacewalk

Sylvain Maes · Publicado 2014-02-05 · Atualizado 2023-02-13 · CVE-2011-3344

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spacewalk version 1.6

Description A cross-site scripting (XSS) issue exists in the Lookup Login/Password form, allowing remote attackers to inject arbitrary web script or HTML via the URI. This could potentially lead to unauthorized access or control of user sessions.

Recommendations For Spacewalk version 1.6, update to a newer version that contains a fix for this issue to prevent remote attackers from injecting arbitrary web script or HTML.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-3344

RHSA-2011:1299

Produtos afetados

Spacewalk

Referências · 7

• https://t.me/cvenotify/43450 · Publicação no Telegram
• https://redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-3344 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=731647 · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2011-1299.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2011-3344 · Nota
• https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=890781d7ec983e32fe83af2f7c033d087292851f · Nota