CVE-2011-4346

Published: Dec 10, 2011Modified: Apr 29, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.

Affected (1)

Products: Redhat: Satellite

Redhat

1 product

Satellite

Configuration A

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Satellite	Version 5.4.1

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux	Version 6.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (10)

http://secunia.com/advisories/47162

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2011-1794.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.securityfocus.com/bid/50963

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1026391

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=742050

Source: secalert@redhat.com

Issue Tracking

http://secunia.com/advisories/47162