CVE-2014-3654
published 2014-11-03CVE-2014-3654: Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.76%
75.4th percentile
Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | satellite | — | — |
| redhat | satellite | — | — |
| redhat | satellite_with_embedded_oracle | — | — |
| redhat | spacewalk-java | — | — |
| suse | manager | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Satellite: Spacewalk contains multiple XSS (stored and reflected)
vendor_redhat·2014-10-30·CVSS 4.3
CVE-2014-3654 [MEDIUM] CWE-79 Satellite: Spacewalk contains multiple XSS (stored and reflected)
Satellite: Spacewalk contains multiple XSS (stored and reflected)
Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.
Stored and reflected cross-site scripting (XSS) flaws were found in the way spacewalk-java displayed certain information. By sending a specially crafted request to Satellite, a remote, authenticated attacker could embed HTML content into the stored data, allowing them to inject malicious content into the web page that is used to view that data.
GHSA
GHSA-8prp-cx44-x9c3: Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2
ghsa_unreviewed·2022-05-13
CVE-2014-3654 [MEDIUM] CWE-79 GHSA-8prp-cx44-x9c3: Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2
Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1762.htmlhttp://secunia.com/advisories/60976http://secunia.com/advisories/62027http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1762.htmlhttp://secunia.com/advisories/60976http://secunia.com/advisories/62027
2014-11-03
Published