CVE Feed

    Dashboard / CVE / CVE-2015-0284

    CVE-2015-0284

    Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.

    Published:Mar 3, 2015
    Last Modified:Apr 12, 2025
    EPS:Apr 14, 2016
    EPSS Score:0.00413
    CVSS Score:5.4

    Affected Products

    Vendor
    Redhat
    Product
    Network Satellite
    Vendor
    Redhat
    Product
    Satellite
    Vendor
    Redhat
    Product
    Spacewalk-java

    Exploits

    No exploit reference

    Related CVEs

    CVE-2020-2604 (CVSS 8.1) — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported…
    CVE-2020-2593 (CVSS 4.8) — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported ve…
    CVE-2020-2659 (CVSS 3.7) — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported ve…
    CVE-2020-2583 (CVSS 3.7) — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported…
    CVE-2019-17631 (CVSS 9.1) — From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnosti…
    CVE-2019-2989 (CVSS 6.8) — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported ve…
    CVE-2019-2973 (CVSS 3.7) — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions…
    CVE-2019-2964 (CVSS 3.7) — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported v…
    CVE-2019-2988 (CVSS 3.7) — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions t…
    CVE-2019-2945 (CVSS 3.1) — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported ve…

    References

    http://rhn.redhat.com/errata/RHSA-2016-0590.html
    https://bugzilla.redhat.com/show_bug.cgi?id=1181152
    https://bugzilla.redhat.com/show_bug.cgi?id=1181472
    https://bugzilla.redhat.com/show_bug.cgi?id=1314906
    https://bugzilla.redhat.com/show_bug.cgi?id=1315398
    https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744
    https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794
    http://rhn.redhat.com/errata/RHSA-2016-0590.html
    https://bugzilla.redhat.com/show_bug.cgi?id=1181152
    https://bugzilla.redhat.com/show_bug.cgi?id=1181472
    https://bugzilla.redhat.com/show_bug.cgi?id=1314906
    https://bugzilla.redhat.com/show_bug.cgi?id=1315398
    https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744
    https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High