CVE-2014-3595 — MEDIUM (4.3)

Vulnerability Description

Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.

CVSS Score

4.3

MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality

NONE

Integrity

PARTIAL

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Satellite	5.4
Redhat	Satellite With Embedded Oracle	5.4
Redhat	Spacewalk-Java	1.2.39
Suse	Manager	1.7
Suse	Suse Linux Enterprise Server	11
Suse	Manager Server	-

Related Weaknesses (CWE)

CWE-79

References

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00031.htmlMailing ListPatchVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.htmlMailing ListPatchVendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1184.htmlVendor Advisory
http://secunia.com/advisories/61115Third Party Advisory
http://secunia.com/advisories/62027Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00031.htmlMailing ListPatchVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.htmlMailing ListPatchVendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1184.htmlVendor Advisory
http://secunia.com/advisories/61115Third Party Advisory
http://secunia.com/advisories/62027Third Party Advisory

FAQ

What is CVE-2014-3595?

CVE-2014-3595 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web sc...

How severe is CVE-2014-3595?

CVE-2014-3595 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-3595?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Satellite, Redhat Satellite With Embedded Oracle, Redhat Spacewalk-Java, Suse Manager, Suse Suse Linux Enterprise Server.