CVE-2015-0284: XSS
First published: Tue Jan 13 2015(Updated: )
Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Satellite | =5.7 | |
| Red Hat Spacewalk |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1315398
- https://rhn.redhat.com/errata/RHSA-2016-0590.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1181472
- http://rhn.redhat.com/errata/RHSA-2016-0590.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1181152
- https://bugzilla.redhat.com/show_bug.cgi?id=1314906
- https://bugzilla.redhat.com/show_bug.cgi?id=1315398
- https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744
- https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794
Frequently Asked Questions
What is the severity of CVE-2015-0284?
CVE-2015-0284 has a medium severity rating due to the potential for remote authenticated users to execute arbitrary web scripts.
How do I fix CVE-2015-0284?
To fix CVE-2015-0284, apply the latest patches provided by Red Hat for Spacewalk and Satellite 5.7.
What software is affected by CVE-2015-0284?
CVE-2015-0284 affects Red Hat Satellite 5.7 and Red Hat Spacewalk Java.
Can CVE-2015-0284 be exploited by unauthenticated users?
No, CVE-2015-0284 can only be exploited by remote authenticated users.
What type of vulnerability is CVE-2015-0284?
CVE-2015-0284 is classified as a cross-site scripting (XSS) vulnerability.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-0284
- agent/weakness
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/redhat
- canonical/red hat satellite
- version/red hat satellite/5.7
- canonical/red hat spacewalk