PT-2014-2144 · Red Hat · Spacewalk

Sylvain Maes · Published 2014-02-05 · Updated 2023-02-13 · CVE-2011-3344

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spacewalk version 1.6

Description A cross-site scripting (XSS) issue exists in the Lookup Login/Password form, allowing remote attackers to inject arbitrary web script or HTML via the URI. This could potentially lead to unauthorized access or control of user sessions.

Recommendations For Spacewalk version 1.6, update to a newer version that contains a fix for this issue to prevent remote attackers from injecting arbitrary web script or HTML.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-3344

RHSA-2011:1299

Affected Products

Spacewalk

References · 7

• https://redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3344 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=731647 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-1299.html · Vendor Advisory
• https://t.me/cvenotify/43450 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2011-3344 · Note
• https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=890781d7ec983e32fe83af2f7c033d087292851f · Note