Spacewalk: spacewalk: cross-site scripting via uri in lookup login/password form
Impact
A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session.
Source excerpt · redhatWhat to do
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Red Hat · redhat
Red Hat Network Satellite Server v 5.4
1 range
Red Hat · redhat
Red Hat Network Satellite Server v 5.4
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:1.2.2-7.el5sat → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:network_satellite:5.4::el5cpe:/a:redhat:network_satellite:5.4::el6Red Hat · redhat
Red Hat Network Satellite Server v 5.4
1 range
Red Hat · redhat
Red Hat Network Satellite Server v 5.4
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:1.2.39-98.el5sat → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:network_satellite:5.4::el5cpe:/a:redhat:network_satellite:5.4::el6Red Hat · redhat
Red Hat Network Satellite Server v 5.4
1 range
Red Hat · redhat
Red Hat Network Satellite Server v 5.4
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:1.2.7-20.el5sat → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:network_satellite:5.4::el5cpe:/a:redhat:network_satellite:5.4::el6Red Hat · redhat
Red Hat Enterprise Linux 6
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 6
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unknown
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:6Red Hat · redhat
Red Hat Enterprise Linux 6
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 6
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unknown
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:6Red Hat · redhat
Red Hat Enterprise Linux 6
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 6
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unknown
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:6Red Hat · redhat
Red Hat Enterprise Linux 7
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unknown
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:7Red Hat · redhat
Red Hat Enterprise Linux 7
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unknown
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:7Original source description
A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2011-3344View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.