CVE-2016-3079
Fixed in a distro release EPSS 2%
Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to systems/SystemEntitlements.do; (2) the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a (3) snapshot tag or (4) system group in System Set Manager (SSM).
Products: redhat satellite, redhat spacewalk-java
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat network satellite 5.7 | spacewalk-java | 0:2.3.8-134.el6sat |
| Red Hat network satellite 5.7 | spacewalk-java-config | 0:2.3.8-134.el6sat |
| Red Hat network satellite 5.7 | spacewalk-java-lib | 0:2.3.8-134.el6sat |
| Red Hat network satellite 5.7 | spacewalk-java-oracle | 0:2.3.8-134.el6sat |
| Red Hat network satellite 5.7 | spacewalk-java-postgresql | 0:2.3.8-134.el6sat |
| Red Hat network satellite 5.7 | spacewalk-taskomatic | 0:2.3.8-134.el6sat |
| SUSE Manager 2.1 | cobbler | 2.2.2-0.61.2 |
| SUSE Manager 2.1 | osad | 5.11.33.11-15.2 |
| SUSE Manager 2.1 | rhnlib | 2.5.69.8-11.2 |
| SUSE Manager 2.1 | spacewalk-backend | 2.1.55.25-24.5 |
| SUSE Manager 2.1 | spacewalk-branding | 2.1.33.16-18.2 |
| SUSE Manager 2.1 | spacewalk-certs-tools | 2.1.6.10-18.3 |
| SUSE Manager 2.1 | spacewalk-java | 2.1.165.23-20.1 |
| SUSE Manager 2.1 | spacewalk-utils | 2.1.27.15-12.7 |
| SUSE Manager 2.1 | suseRegisterInfo | 2.1.12-14.2 |
| SUSE Manager 2.1 | susemanager | 2.1.24-23.1 |
| SUSE Manager 2.1 | susemanager-sync-data | 2.1.15-30.2 |
| SUSE Manager 2.1 | susemanager-tftpsync | 2.1.2-11.2 |