PT-2014-5437 · Red Hat · Spacewalk-Java+1

Publicado 2014-11-03 · Atualizado 2023-02-13 · CVE-2014-3654

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions spacewalk-java version 2.0.2 Red Hat Network (RHN) Satellite versions 5.5 through 5.6

Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to API endpoints such as "kickstart/cobbler/CustomSnippetList.do", "channels/software/Entitlements.do", or "admin/multiorg/OrgUsers.do".

Recommendations For spacewalk-java version 2.0.2, update to a version that contains a fix for this issue. For Red Hat Network (RHN) Satellite versions 5.5 through 5.6, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the affected API endpoints "kickstart/cobbler/CustomSnippetList.do", "channels/software/Entitlements.do", and "admin/multiorg/OrgUsers.do" until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-3654

RHSA-2014:1762

Produtos afetados

Red Hat Network Satellite

Spacewalk-Java

Referências · 6

• http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.html · Aviso do Fabricante
• http://secunia.com/advisories/60976 · Nota
• http://secunia.com/advisories/62027 · Nota
• http://rhn.redhat.com/errata/RHSA-2014-1762.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3654 · Nota de Segurança