CVE-2015-0284: XSS
Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
Other sources
Jan Hutař reports:
There is stored XSS vulnerability in user details field in Satellite server, they can be exploited by using the XMLRPC API to send XML data containing malformed data.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0284?
CVE-2015-0284 has a medium severity rating due to the potential for remote authenticated users to execute arbitrary web scripts.
How do I fix CVE-2015-0284?
To fix CVE-2015-0284, apply the latest patches provided by Red Hat for Spacewalk and Satellite 5.7.
What software is affected by CVE-2015-0284?
CVE-2015-0284 affects Red Hat Satellite 5.7 and Red Hat Spacewalk Java.
Can CVE-2015-0284 be exploited by unauthenticated users?
No, CVE-2015-0284 can only be exploited by remote authenticated users.
What type of vulnerability is CVE-2015-0284?
CVE-2015-0284 is classified as a cross-site scripting (XSS) vulnerability.