Vulnerability-Lookup

RHSA-2016_0590

Vulnerability from csaf_redhat - Published: 2016-04-04 15:35 - Updated: 2024-11-22 09:57

Summary

Red Hat Security Advisory: spacewalk-java security update

Severity

Moderate

Notes

Topic: An update for spacewalk-java is now available for Red Hat Satellite 5.7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Red Hat Satellite is a system management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and the remote management of multiple Linux deployments with a single, centralized tool. Security Fix(es): * A cross-site scripting (XSS) flaw was found in how XML data was handled in Red Hat Satellite. A user able to use the XMLRPC API could exploit this flaw to perform XSS attacks against other Satellite users. (CVE-2015-0284) * Multiple cross-site scripting (XSS) flaws were found in the way certain form data was handled in Red Hat Satellite. A user able to enter form data could use these flaws to perform XSS attacks against other Satellite users. (CVE-2016-2103, CVE-2016-3079) * Multiple cross-site scripting (XSS) flaws were found in the way HTTP GET parameter data was handled in Red Hat Satellite. A user able to provide malicious links to a Satellite user could use these flaws to perform XSS attacks against other Satellite users. (CVE-2016-2104) Red Hat would like to thank Adam Willard (Raytheon Foreground Security) for reporting CVE-2016-2104. The CVE-2015-0284 and CVE-2016-3079 issues were discovered by Jan Hutař (Red Hat).

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2015-0284

A cross-site scripting (XSS) flaw was found in how XML data was handled in Red Hat Satellite. A user able to use the XMLRPC API could exploit this flaw to perform XSS attacks against other Satellite users.

3.5 ()


                
                  AV:N/AC:M/Au:S/C:N/I:P/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 7 products

Product	Version	Remediation
Unresolved product id: 6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch	—	Vendor Fix fix
Unresolved product id: 6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src	—	Vendor Fix fix
Unresolved product id: 6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch	—	Vendor Fix fix
Unresolved product id: 6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch	—	Vendor Fix fix
Unresolved product id: 6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch	—	Vendor Fix fix
Unresolved product id: 6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch	—	Vendor Fix fix
Unresolved product id: 6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2016-2103

Multiple cross-site scripting (XSS) flaws were found in the way certain form data was handled in Red Hat Satellite. A user able to enter form data could use these flaws to perform XSS attacks against other Satellite users.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 7 products, the same list as for CVE-2015-0284

Threats

Impact Moderate

CVE-2016-2104

Multiple cross-site scripting (XSS) flaws were found in the way HTTP GET parameter data was handled in Red Hat Satellite. A user able to provide malicious links to a Satellite user could use these flaws to perform XSS attacks against other Satellite users.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 7 products, the same list as for CVE-2015-0284

Threats

Impact Moderate

CVE-2016-3079

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 7 products, the same list as for CVE-2015-0284

Threats

Impact Moderate

References

28 references

URL	Category
https://access.redhat.com/errata/RHSA-2016:0590	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=1181152	external
https://bugzilla.redhat.com/show_bug.cgi?id=1181472	external
https://bugzilla.redhat.com/show_bug.cgi?id=1305677	external
https://bugzilla.redhat.com/show_bug.cgi?id=1305681	external
https://bugzilla.redhat.com/show_bug.cgi?id=1313515	external
https://bugzilla.redhat.com/show_bug.cgi?id=1313517	external
https://bugzilla.redhat.com/show_bug.cgi?id=1320444	external
https://bugzilla.redhat.com/show_bug.cgi?id=1320452	external
https://bugzilla.redhat.com/show_bug.cgi?id=1320940	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2015-0284	self
https://bugzilla.redhat.com/show_bug.cgi?id=1181472	external
https://www.cve.org/CVERecord?id=CVE-2015-0284	external
https://nvd.nist.gov/vuln/detail/CVE-2015-0284	external
https://access.redhat.com/security/cve/CVE-2016-2103	self
https://bugzilla.redhat.com/show_bug.cgi?id=1305681	external
https://www.cve.org/CVERecord?id=CVE-2016-2103	external
https://nvd.nist.gov/vuln/detail/CVE-2016-2103	external
https://access.redhat.com/security/cve/CVE-2016-2104	self
https://bugzilla.redhat.com/show_bug.cgi?id=1305677	external
https://www.cve.org/CVERecord?id=CVE-2016-2104	external
https://nvd.nist.gov/vuln/detail/CVE-2016-2104	external
https://access.redhat.com/security/cve/CVE-2016-3079	self
https://bugzilla.redhat.com/show_bug.cgi?id=1320940	external
https://www.cve.org/CVERecord?id=CVE-2016-3079	external
https://nvd.nist.gov/vuln/detail/CVE-2016-3079	external

Acknowledgments

Red Hat Jan Hutař

Raytheon Foreground Security Adam Willard

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for spacewalk-java is now available for Red Hat Satellite 5.7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Satellite is a system management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and the remote management of multiple Linux deployments with a single, centralized tool.\n\nSecurity Fix(es):\n\n* A cross-site scripting (XSS) flaw was found in how XML data was handled in Red Hat Satellite. A user able to use the XMLRPC API could exploit this flaw to perform XSS attacks against other Satellite users. (CVE-2015-0284)\n\n* Multiple cross-site scripting (XSS) flaws were found in the way certain form data was handled in Red Hat Satellite. A user able to enter form data could use these flaws to perform XSS attacks against other Satellite users. (CVE-2016-2103, CVE-2016-3079)\n\n* Multiple cross-site scripting (XSS) flaws were found in the way HTTP GET parameter data was handled in Red Hat Satellite. A user able to provide malicious links to a Satellite user could use these flaws to perform XSS attacks against other Satellite users. (CVE-2016-2104)\n\nRed Hat would like to thank Adam Willard (Raytheon Foreground Security) for reporting CVE-2016-2104. The CVE-2015-0284 and CVE-2016-3079 issues were discovered by Jan Huta\u0159 (Red Hat).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:0590",
        "url": "https://access.redhat.com/errata/RHSA-2016:0590"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1181152",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1181152"
      },
      {
        "category": "external",
        "summary": "1181472",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1181472"
      },
      {
        "category": "external",
        "summary": "1305677",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1305677"
      },
      {
        "category": "external",
        "summary": "1305681",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1305681"
      },
      {
        "category": "external",
        "summary": "1313515",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313515"
      },
      {
        "category": "external",
        "summary": "1313517",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313517"
      },
      {
        "category": "external",
        "summary": "1320444",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1320444"
      },
      {
        "category": "external",
        "summary": "1320452",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1320452"
      },
      {
        "category": "external",
        "summary": "1320940",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1320940"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0590.json"
      }
    ],
    "title": "Red Hat Security Advisory: spacewalk-java security update",
    "tracking": {
      "current_release_date": "2024-11-22T09:57:18+00:00",
      "generator": {
        "date": "2024-11-22T09:57:18+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2016:0590",
      "initial_release_date": "2016-04-04T15:35:36+00:00",
      "revision_history": [
        {
          "date": "2016-04-04T15:35:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-04-04T15:35:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T09:57:18+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 5.7 (RHEL v.6)",
                "product": {
                  "name": "Red Hat Satellite 5.7 (RHEL v.6)",
                  "product_id": "6Server-Satellite57",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:network_satellite:5.7::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "spacewalk-java-0:2.3.8-134.el6sat.src",
                "product": {
                  "name": "spacewalk-java-0:2.3.8-134.el6sat.src",
                  "product_id": "spacewalk-java-0:2.3.8-134.el6sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spacewalk-java@2.3.8-134.el6sat?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "spacewalk-java-0:2.3.8-134.el6sat.noarch",
                "product": {
                  "name": "spacewalk-java-0:2.3.8-134.el6sat.noarch",
                  "product_id": "spacewalk-java-0:2.3.8-134.el6sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spacewalk-java@2.3.8-134.el6sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
                "product": {
                  "name": "spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
                  "product_id": "spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spacewalk-java-oracle@2.3.8-134.el6sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch",
                "product": {
                  "name": "spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch",
                  "product_id": "spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spacewalk-taskomatic@2.3.8-134.el6sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
                "product": {
                  "name": "spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
                  "product_id": "spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spacewalk-java-postgresql@2.3.8-134.el6sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
                "product": {
                  "name": "spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
                  "product_id": "spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spacewalk-java-config@2.3.8-134.el6sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
                "product": {
                  "name": "spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
                  "product_id": "spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/spacewalk-java-lib@2.3.8-134.el6sat?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-java-0:2.3.8-134.el6sat.noarch as a component of Red Hat Satellite 5.7 (RHEL v.6)",
          "product_id": "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch"
        },
        "product_reference": "spacewalk-java-0:2.3.8-134.el6sat.noarch",
        "relates_to_product_reference": "6Server-Satellite57"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-java-0:2.3.8-134.el6sat.src as a component of Red Hat Satellite 5.7 (RHEL v.6)",
          "product_id": "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src"
        },
        "product_reference": "spacewalk-java-0:2.3.8-134.el6sat.src",
        "relates_to_product_reference": "6Server-Satellite57"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-java-config-0:2.3.8-134.el6sat.noarch as a component of Red Hat Satellite 5.7 (RHEL v.6)",
          "product_id": "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch"
        },
        "product_reference": "spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
        "relates_to_product_reference": "6Server-Satellite57"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-java-lib-0:2.3.8-134.el6sat.noarch as a component of Red Hat Satellite 5.7 (RHEL v.6)",
          "product_id": "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch"
        },
        "product_reference": "spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
        "relates_to_product_reference": "6Server-Satellite57"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch as a component of Red Hat Satellite 5.7 (RHEL v.6)",
          "product_id": "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch"
        },
        "product_reference": "spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
        "relates_to_product_reference": "6Server-Satellite57"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch as a component of Red Hat Satellite 5.7 (RHEL v.6)",
          "product_id": "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch"
        },
        "product_reference": "spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
        "relates_to_product_reference": "6Server-Satellite57"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch as a component of Red Hat Satellite 5.7 (RHEL v.6)",
          "product_id": "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
        },
        "product_reference": "spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch",
        "relates_to_product_reference": "6Server-Satellite57"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Jan Huta\u0159"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2015-0284",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2015-01-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1181472"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A cross-site scripting (XSS) flaw was found in how XML data was handled in Red Hat Satellite. A user able to use the XMLRPC API could exploit this flaw to perform XSS attacks against other Satellite users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Satellite: stored XSS in user details fields (incomplete fix for CVE-2014-7811)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
          "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-0284"
        },
        {
          "category": "external",
          "summary": "RHBZ#1181472",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1181472"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-0284",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-0284"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0284",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0284"
        }
      ],
      "release_date": "2015-03-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-04-04T15:35:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
            "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:0590"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
            "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Satellite: stored XSS in user details fields (incomplete fix for CVE-2014-7811)"
    },
    {
      "cve": "CVE-2016-2103",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-01-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1305681"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple cross-site scripting (XSS) flaws were found in the way certain form data was handled in Red Hat Satellite. A user able to enter form data could use these flaws to perform XSS attacks against other Satellite users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "5: multiple stored XSS vulnerabilities",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
          "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2103"
        },
        {
          "category": "external",
          "summary": "RHBZ#1305681",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1305681"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2103",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2103"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2103",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2103"
        }
      ],
      "release_date": "2016-02-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-04-04T15:35:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
            "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:0590"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
            "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "5: multiple stored XSS vulnerabilities"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Adam Willard"
          ],
          "organization": "Raytheon Foreground Security"
        }
      ],
      "cve": "CVE-2016-2104",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-02-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1305677"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple cross-site scripting (XSS) flaws were found in the way HTTP GET parameter data was handled in Red Hat Satellite. A user able to provide malicious links to a Satellite user could use these flaws to perform XSS attacks against other Satellite users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "5: stored and reflected XSS vulnerabilities",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
          "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2104"
        },
        {
          "category": "external",
          "summary": "RHBZ#1305677",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1305677"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2104",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2104"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2104",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2104"
        }
      ],
      "release_date": "2016-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-04-04T15:35:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
            "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:0590"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
            "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "5: stored and reflected XSS vulnerabilities"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jan Huta\u0159"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2016-3079",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-03-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1320940"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple cross-site scripting (XSS) flaws were found in the way certain form data was handled in Red Hat Satellite. A user able to enter form data could use these flaws to perform XSS attacks against other Satellite users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "spacewalk-java: Multiple XSS issues in WebUI",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
          "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
          "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-3079"
        },
        {
          "category": "external",
          "summary": "RHBZ#1320940",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1320940"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-3079",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-3079"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3079",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3079"
        }
      ],
      "release_date": "2016-03-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-04-04T15:35:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
            "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:0590"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-0:2.3.8-134.el6sat.src",
            "6Server-Satellite57:spacewalk-java-config-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-lib-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-oracle-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-java-postgresql-0:2.3.8-134.el6sat.noarch",
            "6Server-Satellite57:spacewalk-taskomatic-0:2.3.8-134.el6sat.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "spacewalk-java: Multiple XSS issues in WebUI"
    }
  ]
}

CVE-2015-0284 (GCVE-0-2015-0284)

Vulnerability from cvelistv5 – Published: 2016-04-14 14:00 – Updated: 2024-08-06 04:03

Summary

Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

7 references

URL	Tags
http://rhn.redhat.com/errata/RHSA-2016-0590.html	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=1181472	x_refsource_CONFIRM
https://github.com/spacewalkproject/spacewalk/com…	x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1315398	x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1314906	x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1181152	x_refsource_CONFIRM
https://github.com/spacewalkproject/spacewalk/com…	x_refsource_CONFIRM

Date Public

2016-04-04 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:03:10.886Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:0590",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0590.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1181472"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1315398"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1314906"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1181152"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-04-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-04-14T13:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:0590",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0590.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1181472"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1315398"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1314906"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1181152"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-0284",
    "datePublished": "2016-04-14T14:00:00.000Z",
    "dateReserved": "2014-11-18T00:00:00.000Z",
    "dateUpdated": "2024-08-06T04:03:10.886Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-2103 (GCVE-0-2016-2103)

Vulnerability from cvelistv5 – Published: 2016-04-14 14:00 – Updated: 2024-08-05 23:17

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the list_1680466951_oldfilterval parameter to systems/PhysicalList.do or (2) unspecified vectors involving systems/VirtualSystemsList.do.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

2 references

URL	Tags
http://rhn.redhat.com/errata/RHSA-2016-0590.html	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=1305681	x_refsource_CONFIRM

Date Public

2016-04-04 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:17:50.580Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:0590",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0590.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1305681"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-04-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the list_1680466951_oldfilterval parameter to systems/PhysicalList.do or (2) unspecified vectors involving systems/VirtualSystemsList.do."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-04-14T13:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:0590",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0590.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1305681"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-2103",
    "datePublished": "2016-04-14T14:00:00.000Z",
    "dateReserved": "2016-01-29T00:00:00.000Z",
    "dateUpdated": "2024-08-05T23:17:50.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-2104 (GCVE-0-2016-2104)

Vulnerability from cvelistv5 – Published: 2017-04-13 14:00 – Updated: 2024-08-05 23:17

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the label parameter to admin/BunchDetail.do; (2) the package_name, (3) search_subscribed_channels, or (4) channel_filter parameter to software/packages/NameOverview.do; or unspecified vectors related to (5) <input:hidden> or (6) <bean:message> tags.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

3 references

URL	Tags
http://rhn.redhat.com/errata/RHSA-2016-0590.html	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=1305677	x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1313515	x_refsource_CONFIRM

Date Public

2016-04-04 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:17:50.570Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:0590",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0590.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1305677"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313515"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-04-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the label parameter to admin/BunchDetail.do; (2) the package_name, (3) search_subscribed_channels, or (4) channel_filter parameter to software/packages/NameOverview.do; or unspecified vectors related to (5) \u003cinput:hidden\u003e or (6) \u003cbean:message\u003e tags."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-13T12:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:0590",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0590.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1305677"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313515"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-2104",
    "datePublished": "2017-04-13T14:00:00.000Z",
    "dateReserved": "2016-01-29T00:00:00.000Z",
    "dateUpdated": "2024-08-05T23:17:50.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-3079 (GCVE-0-2016-3079)

Vulnerability from cvelistv5 – Published: 2016-04-14 14:00 – Updated: 2024-08-05 23:40

Summary

Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to systems/SystemEntitlements.do; (2) the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a (3) snapshot tag or (4) system group in System Set Manager (SSM).

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

8 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1320444	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2016-0590.html	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=1320940	x_refsource_CONFIRM
https://github.com/spacewalkproject/spacewalk/com…	x_refsource_CONFIRM
https://github.com/spacewalkproject/spacewalk/com…	x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1320452	x_refsource_CONFIRM
https://github.com/spacewalkproject/spacewalk/com…	x_refsource_CONFIRM
https://github.com/spacewalkproject/spacewalk/com…	x_refsource_CONFIRM

Date Public

2016-04-04 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:40:15.546Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1320444"
          },
          {
            "name": "RHSA-2016:0590",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0590.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1320940"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/spacewalkproject/spacewalk/commit/7b9ff9ad"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/spacewalkproject/spacewalk/commit/b6491eba"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1320452"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/spacewalkproject/spacewalk/commit/982b11c9"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/spacewalkproject/spacewalk/commit/7920542f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-04-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to systems/SystemEntitlements.do; (2) the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a (3) snapshot tag or (4) system group in System Set Manager (SSM)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-04-14T13:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1320444"
        },
        {
          "name": "RHSA-2016:0590",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0590.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1320940"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spacewalkproject/spacewalk/commit/7b9ff9ad"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spacewalkproject/spacewalk/commit/b6491eba"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1320452"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spacewalkproject/spacewalk/commit/982b11c9"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spacewalkproject/spacewalk/commit/7920542f"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-3079",
    "datePublished": "2016-04-14T14:00:00.000Z",
    "dateReserved": "2016-03-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T23:40:15.546Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2016_0590

CVE-2015-0284 (GCVE-0-2015-0284)

CVE-2016-2103 (GCVE-0-2016-2103)

CVE-2016-2104 (GCVE-0-2016-2104)

CVE-2016-3079 (GCVE-0-2016-3079)

Tags

Sightings

Nomenclature

Related by attack behaviour