CVE-2011-4346: XSS
A cross-site scripting (XSS) flaw was found in the way the 'System Details' => 'Details' => 'Custom Info' page of the Red Hat Network Satellite web interface sanitized value (the Description field) of the asset tag / key, assigned to the particular system, created via 'Custom System Info' page. An authenticated Red Hat Network Satellite user could use this flaw to execute arbitrary HTML or web script code via specially-crafted value for the asset 'Custom System Info' key.
Acknowledgements:
Red Hat would like to thank William Hoffmann for reporting this issue.
Other sources
Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4346?
CVE-2011-4346 is classified as a medium severity vulnerability due to its potential impact on web application security through cross-site scripting.
How do I fix CVE-2011-4346?
To fix CVE-2011-4346, upgrade to the secure version of the spacewalk-web package, specifically 0:1.2.7-21.el5, or apply any recommended patches from Red Hat.
What is the main impact of CVE-2011-4346?
The main impact of CVE-2011-4346 is that it allows attackers to exploit a cross-site scripting vulnerability on the Red Hat Network Satellite web interface.
Which versions of Red Hat Satellite are affected by CVE-2011-4346?
CVE-2011-4346 affects the Red Hat Satellite version 5.4.1 and certain older versions of the spacewalk-web package.
Is Red Hat Enterprise Linux vulnerable to CVE-2011-4346?
Red Hat Enterprise Linux versions 5.0 and 6.0 are not vulnerable to CVE-2011-4346, but specific components like the satellite server are impacted.