CVE-2011-4346: XSS
First published: Wed Sep 28 2011(Updated: )
A cross-site scripting (XSS) flaw was found in the way the 'System Details' => 'Details' => 'Custom Info' page of the Red Hat Network Satellite web interface sanitized value (the Description field) of the asset tag / key, assigned to the particular system, created via 'Custom System Info' page. An authenticated Red Hat Network Satellite user could use this flaw to execute arbitrary HTML or web script code via specially-crafted value for the asset 'Custom System Info' key. Acknowledgements: Red Hat would like to thank William Hoffmann for reporting this issue.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/spacewalk-web | <0:1.2.7-21.el5 | 0:1.2.7-21.el5 |
| Redhat Satellite | =5.4.1 | |
| Redhat Enterprise Linux | =5.0 | |
| Redhat Enterprise Linux | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/47162
- http://www.redhat.com/support/errata/RHSA-2011-1794.html
- http://www.securitytracker.com/id?1026391
- https://bugzilla.redhat.com/show_bug.cgi?id=742050
- http://www.securityfocus.com/bid/50963
- https://www.cve.org/CVERecord?id=CVE-2011-4346 https://nvd.nist.gov/vuln/detail/CVE-2011-4346
- https://access.redhat.com/errata/RHSA-2011:1794
- https://access.redhat.com/security/cve/CVE-2011-4346
- https://rhn.redhat.com/errata/RHSA-2011-1794.html
- collector/nvd-historical
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-4346
- package-manager/redhat
- vendor/redhat
- canonical/redhat satellite
- version/redhat satellite/5.4.1
- canonical/redhat enterprise linux
- version/redhat enterprise linux/5.0
- version/redhat enterprise linux/6.0