Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.
It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum.
A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.
It is reported that the Spacewalk 2.6 API contains an XXE flaw resulting in information disclosure.
Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATHINFO to systems/SystemEntitlements.do; (2) the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a (3) snapshot tag or (4) system group in System Set Manager (SSM).
Jan Hutař of Red Hat reports a XSS vulnerability in the handling of the users first and last name within the Web UI.
External reference: spacewalk git dd418384171473c3e31386a1b4792f8c555dc744 spacewalk git f3792c79c1c251a49cc4e382be8591636326a794
Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allow remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the REST API.
Cross-site scripting (XSS) vulnerability in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allows remote authenticated users to inject arbitrary web script or HTML via the System Groups field.
Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.
Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.
Multiple cross-site scripting (XSS) flaws were found in the way Red Hat Satellite and Spacewalk services used to sanitize content of various query string (QS) variables when performing search for various entities:
when performing search for software channels value of 'whereCriteria' QS variable was incorrectly sanitized,
when performing search for scap audit results the values of the following QS variables were incorrectly sanitized:
'endyear', 'starthour', 'endampm', 'endday', 'endhour', 'endminute', 'endmonth', 'endyear', 'optionScanDateSearch', 'resultfilter', 'searchstring', 'showas', 'startampm', 'startday', 'starthour', 'startminute', 'startmonth', 'startyear', and 'whereToSearch',
when performing search for errata the values of the following QS variables were incorrectly sanitized:
'endminute', 'endmonth', 'endyear', 'erratatypebug', 'erratatypeenhancement', 'erratatypesecurity', 'fineGrained', 'list1892635924sortdir', 'optionIssueDateSearch', 'startampm', 'startday', 'starthour', 'startminute', 'startmonth', 'startyear', and 'viewmode',
when performing search for systems the value of the 'fineGrained' QS variable was incorrectly sanitized.
Remote attacker could provide a specially-crafted web page that, when visited by authenticated Red Hat Satellite or Spacewalk user would lead to arbitrary HTML or web script execution in the context of Red Hat Satellite's / Spacewalk's user's session.
Multiple cross-site scripting (XSS) vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) subject or (2) content values of a note in a system.addNote XML-RPC call.
Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page.