CVE-2013-1823: XSS
Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.
Other sources
Suresh Thiru (sthirugn) of Red Hat reports:
Description of problem: In Notifications page, the Username should escape html characters
Steps to Reproduce: 1. Create a user named <blink>FOOO</blink> 2. Go to Notifications page and notice that FOOO is in blinking mode in the page Actual results: FOOO is in html blinking mode in the Notifications page
Expected results: Username should be displayed fully in Notifications page: <blink>FOOO</blink>
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1823?
CVE-2013-1823 is classified as a moderate severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2013-1823?
To fix CVE-2013-1823, upgrade Red Hat Subscription Asset Manager to version 1.2.1 or later.
What software is affected by CVE-2013-1823?
CVE-2013-1823 affects Red Hat Subscription Asset Manager versions up to and including 1.2.0.
What type of vulnerability is CVE-2013-1823?
CVE-2013-1823 is a cross-site scripting (XSS) vulnerability.
Who reported the CVE-2013-1823 vulnerability?
CVE-2013-1823 was reported by Suresh Thiru (sthirugn) of Red Hat.