Description
Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | spacewalk-java +4 | 1.7.54-131.el5sat | RHSA-2014:1762 |
| Red Hat Network Satellite 5 | spacewalk-java-postgresql | 2.0.2-90.el5sat | RHSA-2014:1762 |
Advisories 1
- RHSA-2014:1762 Red Hat Security Advisory: spacewalk-java security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 60976 third-party-advisory
- 62027 third-party-advisory
- SUSE-SU-2014:1339 vendor-advisory
- SUSE-SU-2014:1342 vendor-advisory
- RHSA-2014:1762 vendor-advisory