Skip to content
OpenAdvisories
Medium · 5.2 CVE-2025-23392 EUVD-2025-27708

Reflected XSS in SystemsController.java in spacewalk-java

Published May 26, 2025 · Updated May 27, 2025 · Assigned by suse

Vendor: SUSE Product: Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1 Product: SUSE Manager Server Module 4.3

Description

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code on target systems.This issue affects Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3.

Affected products

VendorProductAffectedFixed
SUSE Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1 ? – < 5.0.24-150600.3.25.1 5.0.24-150600.3.25.1
SUSE SUSE Manager Server Module 4.3 ? – < 4.3.85-150400.3.105.3 4.3.85-150400.3.105.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Manager Server Module 4.3 cobbler 3.3.3-150400.5.58.3 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 grafana-formula 4.3.0-150400.3.24.2 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 inter-server-sync 0.3.7-150400.3.39.4 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 spacecmd 4.3.31-150400.3.48.2 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 spacewalk-admin 4.3.14-150400.3.15.3 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 spacewalk-backend 4.3.33-150400.3.55.2 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 spacewalk-client-tools 4.3.23-150400.3.39.3 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 spacewalk-config 4.3.16-150400.3.24.2 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 spacewalk-java 4.3.85-150400.3.105.3 SUSE-SU-2025:1321-1, SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 spacewalk-utils 4.3.24-150400.3.35.4 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 spacewalk-web 4.3.45-150400.3.60.3 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 subscription-matcher 0.40-150400.3.28.2 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 supportutils-plugin-susemanager 4.3.15-150400.3.33.2 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 susemanager 4.3.42-150400.3.66.1 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 susemanager-build-keys 15.4.11-150400.3.35.2 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 susemanager-docs_en 4.3.16-150400.9.72.2 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 susemanager-schema 4.3.29-150400.3.51.2 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 susemanager-sls 4.3.47-150400.3.61.4 SUSE-SU-2025:02475-1
SUSE Manager Server Module 4.3 susemanager-sync-data 4.3.24-150400.3.44.2 SUSE-SU-2025:02475-1
SUSE Manager Server 4.3 release-notes-susemanager 4.3.16-150400.3.140.1 SUSE-SU-2025:02476-1
SUSE Manager Proxy Module 4.3 mgr-daemon 4.3.12-150400.3.24.2 SUSE-SU-2025:02475-1
SUSE Manager Proxy Module 4.3 spacecmd 4.3.31-150400.3.48.2 SUSE-SU-2025:02475-1
SUSE Manager Proxy Module 4.3 spacewalk-backend 4.3.33-150400.3.55.2 SUSE-SU-2025:02475-1
SUSE Manager Proxy Module 4.3 spacewalk-client-tools 4.3.23-150400.3.39.3 SUSE-SU-2025:02475-1
SUSE Manager Proxy Module 4.3 spacewalk-proxy-installer 4.3.12-150400.3.9.2 SUSE-SU-2025:02475-1
SUSE Manager Proxy Module 4.3 spacewalk-web 4.3.45-150400.3.60.3 SUSE-SU-2025:02475-1
SUSE Manager Proxy Module 4.3 supportutils-plugin-susemanager-proxy +1 4.3.5-150400.3.9.2 SUSE-SU-2025:02475-1
SUSE Manager Proxy Module 4.3 susemanager-build-keys 15.4.11-150400.3.35.2 SUSE-SU-2025:02475-1
SUSE Manager Proxy Module 4.3 susemanager-tftpsync-recv 4.3.10-150400.3.12.2 SUSE-SU-2025:02475-1
SUSE Manager Proxy Module 4.3 uyuni-proxy-systemd-services 4.3.16-150000.1.33.1 SUSE-SU-2025:02475-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Manager Proxy 4.3 release-notes-susemanager-proxy 4.3.16-150400.3.98.1 SUSE-SU-2025:02476-1
SUSE Manager Client Tools for SLE Micro 5 uyuni-proxy-systemd-services 4.3.16-150000.1.33.1 SUSE-SU-2025:02475-1
SUSE Manager Client Tools 15 uyuni-proxy-systemd-services 4.3.16-150000.1.33.1 SUSE-SU-2025:02475-1

Advisories 3

References