Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:22
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://rhn.redhat.com/errata/RHSA-2016-0590.html - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=1181152 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=1181472 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=1314906 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=1315398 - | |
| References | () https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744 - | |
| References | () https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794 - |
07 Nov 2023, 02:23
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811. |
Information
Published : 2016-04-14 14:59
Updated : 2024-11-21 02:22
NVD link : CVE-2015-0284
Mitre link : CVE-2015-0284
CVE.ORG link : CVE-2015-0284
JSON object : View
Products Affected
redhat
- spacewalk-java
- satellite
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')