Bug 1320444 - (CVE-2016-3079) XSS on pages for entitlements management
Summary: (CVE-2016-3079) XSS on pages for entitlements management
Alias: None
Product: Red Hat Satellite 5
Classification: Red Hat
Component: WebUI
Version: 570
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Grant Gainey
QA Contact: Red Hat Satellite QA List
Keywords: Security
Depends On:
Blocks: CVE-2016-3079
TreeView+ depends on / blocked
Reported: 2016-03-23 09:01 UTC by Jan Hutař
Modified: 2016-04-04 15:37 UTC (History)
1 user (show)

Clone Of:
Last Closed: 2016-04-04 15:37:17 UTC

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:0590 normal SHIPPED_LIVE Moderate: spacewalk-java security update 2016-04-04 19:35:36 UTC

Description Jan Hutař 2016-03-23 09:01:09 UTC
Description of problem:
There are two XSS issues on pages for entitlements management.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. /rhn/systems/SystemEntitlements.do?"><script>alert(1)</script>
   (make sure you have some system registered)
2. /rhn/admin/multiorg/EntitlementDetails.do?label=enterprise_entitled"><script>alert(1)</script>

Actual results:
JavaScript alert gets executed.

Expected results:
Alert should not be executed.

Comment 2 Grant Gainey 2016-03-29 18:48:04 UTC
Problem 1) fixed by the AlphaBar fix as part of 1313517

Problem 2) spacewalk.github:

Comment 3 Grant Gainey 2016-03-29 19:28:48 UTC

Comment 8 errata-xmlrpc 2016-04-04 15:37:17 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.