PT-2025-22644 · Suse · Spacewalk-Java

CVE-2025-23392 · Published 2025-04-16 · Updated 2025-07-23

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions spacewalk-java versions prior to 4.3.85-150400.3.105.3 spacewalk-java versions prior to 5.0.24-150600.3.25.1

Description A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code on target systems. This issue affects SUSE Manager Server Module and Container suse/manager. The vulnerability can be exploited by filtering user input in systems list page.

Recommendations For versions prior to 4.3.85-150400.3.105.3, update to version 4.3.85-150400.3.105.3 or later. For versions prior to 5.0.24-150600.3.25.1, update to version 5.0.24-150600.3.25.1 or later. As a temporary workaround, consider filtering user input in the systems list page to prevent arbitrary Javascript code execution.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-23392

SUSE-SU-2025:02475-1

SUSE-SU-2025:02476-1

SUSE-SU-2025:1321-1

Affected Products

Spacewalk-Java

References · 85

• https://osv.dev/vulnerability/SUSE-SU-2025:1321-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02475-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23392 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:02476-1 · Vendor Advisory
• https://bugzilla.suse.com/1240386 · Note
• https://bugzilla.suse.com/1239102 · Note
• https://bugzilla.suse.com/1225740 · Note
• https://t.me/cvetracker/24660 · Telegram Post
• https://bugzilla.suse.com/1230908 · Note
• https://bugzilla.suse.com/1243724 · Note
• https://bugzilla.suse.com/1211373 · Note
• https://bugzilla.suse.com/1237694 · Note
• https://bugzilla.suse.com/1243825 · Note
• https://suse.com/security/cve/CVE-2025-22237 · Note
• https://bugzilla.suse.com/1242554 · Note