PT-2016-3556 · Red Hat · Spacewalk+1

Jiridostal · Published 2016-04-14 · Updated 2023-02-13 · CVE-2015-0284

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Spacewalk and Red Hat Satellite version 5.7

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details.

Recommendations For Spacewalk and Red Hat Satellite version 5.7, as a temporary workaround, consider restricting access to the XMLRPC API until a patch is available. Avoid using crafted XML data in the API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-0284

RHSA-2016:0590

SUSE-SU-2016:1367-1

Affected Products

Red Hat Satellite

Spacewalk

References · 44

• http://rhn.redhat.com/errata/RHSA-2016-0590.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0284 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:1367-1 · Vendor Advisory
• https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744 · Note
• https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794 · Note
• https://bugzilla.suse.com/958923 · Note
• https://bugzilla.suse.com/961002 · Note
• https://bugzilla.suse.com/974011 · Note
• https://bugzilla.suse.com/974315 · Note
• https://bugzilla.suse.com/968257 · Note
• https://suse.com/security/cve/CVE-2016-2104 · Note
• https://bugzilla.suse.com/978166 · Note
• https://bugzilla.suse.com/924298 · Note
• https://bugzilla.suse.com/973432 · Note
• https://bugzilla.suse.com/966737 · Note