Description
Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | cumin | 0.1.5192-4.el5 | RHSA-2012:0477, RHSA-2012:0476 |
Advisories 2
- RHSA-2012:0477 Red Hat Security Advisory: Red Hat Enterprise MRG Management Console security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2012:0476 Red Hat Security Advisory: Red Hat Enterprise MRG Management Console security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 48810 third-party-advisory
- 53000 vdb-entry
- [cumin-developers] 20120306 r5238 - in trunk: cumin/python/cumin cumin/python/cumin/grid cumin/python/cumin/inventory cumin/python/cumin/messaging rosemary/python/rosemary wooly/python/wooly mailing-list
- RHSA-2012:0476 vendor-advisory
- cumin-redhat-unspec-xss(74844) vdb-entry
- RHSA-2012:0477 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=805712
- 1026921 vdb-entry
- https://bugzilla.redhat.com/attachment.cgi?id=571986
- 48829 third-party-advisory