Bug 882000 (CVE-2012-6149)

Summary: CVE-2012-6149 Satellite, Spacewalk (spacewalk-java): XSS in system.addNote XML-RPC call due improper sanitization of note's subject and content
Product: [Other] Security Response Reporter: Ben Ford <binford2k+rh>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact: Lukas Pramuk <lpramuk>
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: cperry, ggainey, jlieskov, jpazdziora, jrusnack, lpramuk, meissner, mmraka, security-response-team, sherr, taw, thomas, tlestach
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: spacewalk-java-2.0.2-57-sat Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-02-11 13:09:02 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1022687    
Bug Blocks: 883016, 915998, 1011743    

Comment 4 Jan Lieskovsky 2012-12-03 15:21:37 UTC 
A cross-site scripting (XSS) flaw was found in the way the web interface of Red Hat Network Satellite / Spacewalk performed sanitization of note's subject and note's content values, for a note being added after system.addNote() XML-RPC request. A remote authenticated Red Hat Network Satellite / Spacewalk user (having systems registered to particular Red Hat Network Satellite / Spacewalk instance) could use this flaw to execute arbitrary HTML or web script, via specially-crafted XML-RPC request, in the context of the session of Red Hat Network Satellite / Spacewalk administrator, if they visited the page, created as a result of that XML-RPC call.
Comment 5 Jan Lieskovsky 2012-12-10 17:53:18 UTC 
Acknowledgements:

Red Hat would like to thank Ben Ford of Puppet Labs for reporting this issue.
Comment 11 errata-xmlrpc 2014-02-10 17:32:57 UTC 
This issue has been addressed in following products:

  Red Hat Satellite Server v 5.6

Via RHSA-2014:0148 https://rhn.redhat.com/errata/RHSA-2014-0148.html