CVE-2017-7538: XSS
A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.
Other sources
Ales Dujicek of Red Hat reports: The organization name is used in a variety of web pages without being sanitized for HTML special characters, resulting in a stored cross site scripting (XSS) vulnerability.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rhn_satelliteto a version that resolves this vulnerability.Fixed in 5.8
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7538?
CVE-2017-7538 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2017-7538?
To fix CVE-2017-7538, upgrade to Red Hat Satellite version 5.8 or later.
Who discovered CVE-2017-7538?
CVE-2017-7538 was reported by Ales Dujicek of Red Hat.
What type of vulnerability is CVE-2017-7538?
CVE-2017-7538 is a cross-site scripting (XSS) vulnerability.
Which software is affected by CVE-2017-7538?
CVE-2017-7538 affects Red Hat Satellite versions prior to 5.8.