CVE-2015-0284

Description

Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.

References

https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794

https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744

https://bugzilla.redhat.com/show_bug.cgi?id=1315398

https://bugzilla.redhat.com/show_bug.cgi?id=1314906

https://bugzilla.redhat.com/show_bug.cgi?id=1181472

https://bugzilla.redhat.com/show_bug.cgi?id=1181152

http://rhn.redhat.com/errata/RHSA-2016-0590.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3