CVE-2015-0284 | BDVDB-2026-75238 Detail
Description#
Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://rhn.redhat.com/errata/RHSA-2016-0590.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1181472
- https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744
- https://bugzilla.redhat.com/show_bug.cgi?id=1315398
- https://bugzilla.redhat.com/show_bug.cgi?id=1314906
- https://bugzilla.redhat.com/show_bug.cgi?id=1181152
- https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.