Red Hat Satellite and Spacewalk Multiple HTML Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	70951
Class:	Input Validation Error
CVE:	CVE-2014-3654
Remote:	Yes
Local:	No
Published:	Oct 30 2014 12:00AM
Updated:	Oct 30 2014 12:00AM
Credit:	Ron Bowes of Google.
Vulnerable:	Redhat Spacewalk 2.0.2 Redhat Satellite (for RHEL 6) 5.6 Redhat Satellite (for RHEL 5) 5.6 Redhat Network Satellite (for RHEL 6) 5.5 Redhat Network Satellite (for RHEL 5) 5.5
Not Vulnerable:

Red Hat Satellite and Spacewalk Multiple HTML Injection and Cross Site Scripting Vulnerabilities

Red Hat Satellite and Spacewalk are prone to multiple HTML-injection vulnerabilities and cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Red Hat Satellite and Spacewalk Multiple HTML Injection and Cross Site Scripting Vulnerabilities

Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issues, an attacker must entice an unsuspecting user into following a malicious URI.

Red Hat Satellite and Spacewalk Multiple HTML Injection and Cross Site Scripting Vulnerabilities

References:

• Spacewalk Homepage (Red Hat)
  
• Moderate: spacewalk-java security update (Ron Bowes)