Vulnerability Details : CVE-2013-4415
Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) whereCriteria variable in a software channels search; (2) end_year, (3) start_hour, (4) end_am_pm, (5) end_day, (6) end_hour, (7) end_minute, (8) end_month, (9) end_year, (10) optionScanDateSearch, (11) result_filter, (12) search_string, (13) show_as, (14) start_am_pm, (15) start_day, (16) start_hour, (17) start_minute, (18) start_month, (19) start_year, or (20) whereToSearch variable in an scap audit results search; (21) end_minute, (22) end_month, (23) end_year, (24) errata_type_bug, (25) errata_type_enhancement, (26) errata_type_security, (27) fineGrained, (28) list_1892635924_sortdir, (29) optionIssueDateSearch, (30) start_am_pm, (31) start_day, (32) start_hour, (33) start_minute, (34) start_month, (35) start_year, or (36) view_mode variable in an errata search; or (37) fineGrained variable in a systems search, related to PAGE_SIZE_LABEL_SELECTED.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2013-4415
Probability of exploitation activity in the next 30 days: 0.36%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 69 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-4415
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2013-4415
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-4415
-
https://www.suse.com/support/update/announcement/2014/suse-su-20140222-1.html
SUSE-SU-2014:0222-1Vendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=979452
979452 – (CVE-2013-4415) CVE-2013-4415 Red Hat Satellite, Spacewalk: PAGE_SIZE_LABEL_SELECTED cross-site scripting (XSS)Issue Tracking;Vendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2014-0148.html
RHSA-2014:0148 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13f
Infrastructure/Fedorahosted-retirement - Fedora Project WikiPatch;Third Party Advisory
Products affected by CVE-2013-4415
- cpe:2.3:a:redhat:spacewalk-java:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:satellite_5_managed_db:5.6:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:spacewalk-web:*:*:*:*:*:*:*:*
- cpe:2.3:a:suse:manager:1.7:*:*:*:*:*:*:*