Bug 713478 (CVE-2011-2919) - CVE-2011-2919 RHN Satellite / Spacewalk: XSS on SystemGroupList.do page
Summary: CVE-2011-2919 RHN Satellite / Spacewalk: XSS on SystemGroupList.do page
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-2919
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 730925 738818
Blocks: 622406 713496
TreeView+ depends on / blocked
 
Reported: 2011-06-15 14:09 UTC by Jan Lieskovsky
Modified: 2023-05-11 17:36 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-09-16 06:48:35 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1299 0 normal SHIPPED_LIVE Moderate: Red Hat Network Satellite server security and enhancement update 2011-09-15 17:54:55 UTC

Description Jan Lieskovsky 2011-06-15 14:09:55 UTC 
It was found that application for listing of system groups in Red Hat Network
Satellite Server and Spacewalk services did not properly HTML escape
the content of QueryString. A remote attacker could use this flaw to conduct
XSS attacks, potentially leading into attacker's ability to steal
the users' session cookie.

Acknowledgements:

Red Hat would like to thank Daniel Karanja Muturi for reporting this issue.
Comment 11 errata-xmlrpc 2011-09-15 17:55:26 UTC 
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2011:1299 https://rhn.redhat.com/errata/RHSA-2011-1299.html
Comment 12 Vincent Danen 2011-09-15 21:24:09 UTC 
Created spacewalk-backend tracking bugs for this issue

Affects: fedora-all [bug 738818]
Comment 13 Jan Pazdziora 2011-09-16 06:41:50 UTC 
(In reply to comment #12)
> Created spacewalk-backend tracking bugs for this issue
> 
> Affects: fedora-all [bug 738818]

I don't quite understand -- the problem (and the fix) is not in spacewalk-backend package.
Comment 14 Jan Pazdziora 2011-09-16 09:32:20 UTC 
Fixed in Spacewalk master, commit 2d9c34e7b682b375ea32595f0dd38b61f424a24f, tagged as spacewalk-java-1.6.46-1.
Comment 15 Vincent Danen 2011-09-16 17:40:13 UTC 
Sorry, thanks for the Jan.  When initially filing this, I suspect some random spacewalk component was selected for the purpose of tracking bugs.  Thank you for clearing it up and resolving that invalid tracker.
Note You need to log in before you can comment on or make changes to this bug.