PT-2016-3556 · Red Hat · Spacewalk+1

Jiridostal · Publicado 2016-04-14 · Atualizado 2023-02-13 · CVE-2015-0284

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Spacewalk and Red Hat Satellite version 5.7

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details.

Recommendations For Spacewalk and Red Hat Satellite version 5.7, as a temporary workaround, consider restricting access to the XMLRPC API until a patch is available. Avoid using crafted XML data in the API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-0284

RHSA-2016:0590

SUSE-SU-2016:1367-1

Produtos afetados

Red Hat Satellite

Spacewalk

Referências · 44

• https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744 · Nota
• https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794 · Nota
• https://bugzilla.suse.com/958923 · Nota
• https://bugzilla.suse.com/961002 · Nota
• https://bugzilla.suse.com/974011 · Nota
• https://bugzilla.suse.com/974315 · Nota
• https://bugzilla.suse.com/968257 · Nota
• https://suse.com/security/cve/CVE-2016-2104 · Nota
• https://bugzilla.suse.com/978166 · Nota
• https://bugzilla.suse.com/924298 · Nota
• https://bugzilla.suse.com/973432 · Nota
• http://rhn.redhat.com/errata/RHSA-2016-0590.html · Aviso do Fabricante
• https://bugzilla.suse.com/966737 · Nota
• https://bugzilla.suse.com/966890 · Nota
• https://bugzilla.suse.com/922740 · Nota