Red Hat Satellite and Spacewalk CVE-2014-7812 HTML Injection Vulnerability

Bugtraq ID:	74829
Class:	Input Validation Error
CVE:	CVE-2014-7812
Remote:	Yes
Local:	No
Published:	Dec 11 2014 12:00AM
Updated:	Dec 11 2014 12:00AM
Credit:	Mickaël Gallier
Vulnerable:	SuSE SUSE Manager for SLE 11 SP2 1.7 Redhat Spacewalk 0 Redhat Satellite (for RHEL 6) 5.6
Not Vulnerable:	Redhat Satellite (for RHEL 6) 5.7

Red Hat Satellite and Spacewalk CVE-2014-7812 HTML Injection Vulnerability

Red Hat Satellite and Spacewalk prone to an HTML-injection vulnerability because they fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Red Hat Satellite and Spacewalk CVE-2014-7812 HTML Injection Vulnerability

An attacker can exploit this issue through a browser.

Red Hat Satellite and Spacewalk CVE-2014-7812 HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Red Hat Satellite and Spacewalk CVE-2014-7812 HTML Injection Vulnerability

References:

• Bug 1172934 - (CVE-2014-7812) CVE-2014-7812 Red Hat Satellite, Spacewalk: XSS in (Red Hat Bugzilla)
  
• Red Hat Network Satellite Homepage (Red Hat)
  
• Spacewalk Homepage (Red Hat)
  
• Moderate: Red Hat Satellite 5.7.0 General Availability (Red Hat)