Skip to content
OpenAdvisories
Low · 3.5 CVE-2024-49503 EUVD-2024-43785GHSA-966m-j2wr-w37h

Reflected XSS in Setup Wizard, Organization Credentials in spacewalk-web

Published Nov 28, 2024 · Updated Nov 28, 2024 · Assigned by suse

Vendor: SUSE Product: Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1 Product: SUSE Manager Server Module 4.3

Description

A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascript code in the organization credentials sub page.
This issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.

Affected products

VendorProductAffectedFixed
SUSE Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1 ? – < 5.0.15-150600.3.10.2 5.0.15-150600.3.10.2
SUSE SUSE Manager Server Module 4.3 ? – < 4.3.42-150400.3.52.1 4.3.42-150400.3.52.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Manager Server Module 4.3 cobbler 3.3.3-150400.5.52.3 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 grafana-formula 0.11.0-150400.3.21.4 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 inter-server-sync 0.3.5-150400.3.36.13 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 saltboot-formula 0.1.1723628891.ffb1da5-150400.3.18.4 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 spacecmd 4.3.29-150400.3.42.8 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 spacewalk-backend 4.3.30-150400.3.47.16 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 spacewalk-certs-tools 4.3.26-150400.3.36.7 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 spacewalk-client-tools 4.3.21-150400.3.33.11 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 spacewalk-config 4.3.14-150400.3.18.6 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 spacewalk-java 4.3.82-150400.3.96.1 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 spacewalk-utils 4.3.22-150400.3.29.2 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 spacewalk-web 4.3.42-150400.3.52.1 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 susemanager 4.3.39-150400.3.58.5 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 susemanager-build-keys 15.4.10-150400.3.29.4 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 susemanager-docs_en 4.3.14-150400.9.66.2 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 susemanager-schema 4.3.27-150400.3.45.11 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 susemanager-sls 4.3.45-150400.3.55.4 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 susemanager-sync-data 4.3.21-150400.3.35.2 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 uyuni-common-libs 4.3.11-150400.3.21.6 SUSE-SU-2024:4006-1
SUSE Manager Server Module 4.3 uyuni-reportdb-schema 4.3.11-150400.3.18.12 SUSE-SU-2024:4006-1
SUSE Manager Server 4.3 release-notes-susemanager 4.3.14-150400.3.122.1 SUSE-SU-2024:4007-1
SUSE Manager Proxy Module 4.3 mgr-daemon +1 4.3.11-150400.3.21.6 SUSE-SU-2024:4006-1
SUSE Manager Proxy Module 4.3 spacecmd 4.3.29-150400.3.42.8 SUSE-SU-2024:4006-1
SUSE Manager Proxy Module 4.3 spacewalk-backend 4.3.30-150400.3.47.16 SUSE-SU-2024:4006-1
SUSE Manager Proxy Module 4.3 spacewalk-certs-tools 4.3.26-150400.3.36.7 SUSE-SU-2024:4006-1
SUSE Manager Proxy Module 4.3 spacewalk-client-tools 4.3.21-150400.3.33.11 SUSE-SU-2024:4006-1
SUSE Manager Proxy Module 4.3 spacewalk-proxy 4.3.19-150400.3.29.9 SUSE-SU-2024:4006-1
SUSE Manager Proxy Module 4.3 spacewalk-web 4.3.42-150400.3.52.1 SUSE-SU-2024:4006-1
SUSE Manager Proxy Module 4.3 susemanager-build-keys 15.4.10-150400.3.29.4 SUSE-SU-2024:4006-1
SUSE Manager Proxy Module 4.3 uyuni-proxy-systemd-services 4.3.14-150000.1.27.4 SUSE-SU-2024:4006-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Manager Proxy 4.3 release-notes-susemanager-proxy 4.3.14-150400.3.90.1 SUSE-SU-2024:4007-1
SUSE Manager Client Tools for SLE Micro 5 uyuni-proxy-systemd-services 4.3.14-150000.1.27.4 SUSE-SU-2024:4006-1
SUSE Manager Client Tools 15 uyuni-proxy-systemd-services 4.3.14-150000.1.27.4 SUSE-SU-2024:4006-1

Advisories 3

References