CVE-2014-3654: XSS
Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.
Affected Software
Remediation
Event History
Frequently Asked Questions
What are the implications of CVE-2014-3654?
CVE-2014-3654 allows remote attackers to inject arbitrary web scripts or HTML via multiple cross-site scripting vulnerabilities.
Who is affected by CVE-2014-3654?
CVE-2014-3654 affects users of Spacewalk and Red Hat Satellite versions 5.5 and 5.6, as well as Red Hat Spacewalk Java version 2.0.2.
How do I fix CVE-2014-3654?
To fix CVE-2014-3654, users should apply the relevant security patches provided by Red Hat for the affected versions.
What is the severity of CVE-2014-3654?
CVE-2014-3654 is considered a medium-severity vulnerability due to its potential for exploitation via XSS.
Is there a workaround for CVE-2014-3654?
Currently, there are no known effective workarounds for mitigating CVE-2014-3654, so patching is the recommended approach.