CVE-2014-3654

Published: Nov 3, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.

Affected (6)

Products: Redhat: Satellite, Satellite With Embedded Oracle, Spacewalk Java · Suse: Manager Server, Manager

3 products

Satellite With Embedded Oracle

2 products

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Satellite	Version 5.5
Redhat Satellite	Version 5.6
Redhat Satellite With Embedded Oracle	Version 5.5
Redhat Spacewalk Java	Version 2.0.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Suse Manager Server	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Suse Manager	Version 1.7

Running on/with	Platform Versions
Suse Suse Linux Enterprise Server	Version 11 sp2

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (10)

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.html

Source: secalert@redhat.com

Mailing ListPatchVendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.html

Source: secalert@redhat.com

Mailing ListPatchVendor Advisory

http://rhn.redhat.com/errata/RHSA-2014-1762.html

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/60976

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/62027

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchVendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchVendor Advisory

http://rhn.redhat.com/errata/RHSA-2014-1762.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/60976

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://secunia.com/advisories/62027

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.