CVE-2013-1823

Published: Apr 2, 2013Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.

Affected (3)

Products: Redhat: Subscription Asset Manager

Redhat

1 product

Subscription Asset Manager

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Subscription Asset Manager	Up to 1.2.0
Redhat Subscription Asset Manager	Version 1.0.0
Redhat Subscription Asset Manager	Version 1.1.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

http://rhn.redhat.com/errata/RHSA-2013-0686.html

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/52774

Source: secalert@redhat.com

Vendor Advisory

http://www.osvdb.org/91718

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=918784

Source: secalert@redhat.com

Exploit

http://rhn.redhat.com/errata/RHSA-2013-0686.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/52774

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.osvdb.org/91718

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=918784

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.