CVE-2014-3654 — MEDIUM (4.3)

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.

CVSS Score

4.3

MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality

NONE

Integrity

PARTIAL

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Satellite	5.5
Redhat	Satellite With Embedded Oracle	5.5
Redhat	Spacewalk-Java	2.0.2
Suse	Manager Server	-
Suse	Manager	1.7
Suse	Suse Linux Enterprise Server	11

Related Weaknesses (CWE)

CWE-79

References

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.htmlMailing ListPatchVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.htmlMailing ListPatchVendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1762.htmlVendor Advisory
http://secunia.com/advisories/60976Third Party Advisory
http://secunia.com/advisories/62027Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.htmlMailing ListPatchVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.htmlMailing ListPatchVendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1762.htmlVendor Advisory
http://secunia.com/advisories/60976Third Party Advisory
http://secunia.com/advisories/62027Third Party Advisory

FAQ

What is CVE-2014-3654?

CVE-2014-3654 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML v...

How severe is CVE-2014-3654?

CVE-2014-3654 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-3654?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Satellite, Redhat Satellite With Embedded Oracle, Redhat Spacewalk-Java, Suse Manager Server, Suse Manager.