Bug 1320444 – (CVE-2016-3079) XSS on pages for entitlements management

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1320444 - (CVE-2016-3079) XSS on pages for entitlements management

Summary:	(CVE-2016-3079) XSS on pages for entitlements management

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Satellite 5
Classification:	Red Hat
Component:	WebUI (Show other bugs)
Sub Component:
Version:	570
Hardware:	Unspecified Unspecified

Priority	unspecified Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Grant Gainey
QA Contact:	Red Hat Satellite QA List
Docs Contact:

URL:
Whiteboard:
Keywords:	Security

Depends On:
Blocks:	CVE-2016-3079
	Show dependency tree / graph

Reported:	2016-03-23 05:01 EDT by Jan Hutař
Modified:	2016-04-04 11:37 EDT (History)
CC List:	1 user (show)

See Also:
Fixed In Version:	spacewalk-java-2.3.8-133-sat
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-04-04 11:37:17 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2016:0590	normal	SHIPPED_LIVE	Moderate: spacewalk-java security update	2016-04-04 15:35:36 EDT

Groups: None (edit)

Description Jan Hutař 2016-03-23 05:01:09 EDT

Description of problem:
There are two XSS issues on pages for entitlements management.


Version-Release number of selected component (if applicable):
spacewalk-java-2.3.8-129.el6sat.noarch


How reproducible:
always


Steps to Reproduce:
1. /rhn/systems/SystemEntitlements.do?"><script>alert(1)</script>
   (make sure you have some system registered)
2. /rhn/admin/multiorg/EntitlementDetails.do?label=enterprise_entitled"><script>alert(1)</script>


Actual results:
JavaScript alert gets executed.


Expected results:
Alert should not be executed.

Comment 2 Grant Gainey 2016-03-29 14:48:04 EDT

Problem 1) fixed by the AlphaBar fix as part of 1313517

Problem 2) spacewalk.github:
7b9ff9ad

Comment 3 Grant Gainey 2016-03-29 15:28:48 EDT

spacewalk.github:
982b11c9

Comment 8 errata-xmlrpc 2016-04-04 11:37:17 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-0590.html

Note You need to log in before you can comment on or make changes to this bug.