Description
Cross-site scripting (XSS) vulnerability in account/EditAddress.do in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite Managed Db 5 | spacewalk-web +2 | 2.0.3-19.el5sat | RHSA-2014:0148 |
| Red Hat Network Satellite 5 | satellite-branding | 5.6.0.23-1.el5sat | RHSA-2014:0148 |
| Red Hat Network Satellite 5 | spacewalk-java +5 | 2.0.2-58.el5sat | RHSA-2014:0148 |
| Red Hat Network Satellite 5 | spacewalk-pxt +8 | 2.0.3-19.el5sat | RHSA-2014:0148 |
Advisories 1
- RHSA-2014:0148 Red Hat Security Advisory: spacewalk-java, spacewalk-web and satellite-branding security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- 56952 third-party-advisory
- RHSA-2014:0148 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=923467
- https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13f
- 103211 vdb-entry
- SUSE-SU-2014:0222 vendor-advisory