CVE-2014-3654: redhat satellite Cross-site Scripting

CVSS: 4.3v2.0MediumModified

AliasesRHSA-2014:1762

Published 03-11-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-3654 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in redhat satellite. EPSS estimates a 1.76% chance of exploitation in the next 30 days, higher than 77.6% of scored vulnerabilities.

Overall risk

18/100

0100

Low · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

1.76%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

03-11-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

1.76%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

0.00 pp

From 1.76% on 18-09-2026

18-09-202618-10-2026

EPSS score

1.76%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Redhat9 products

satellite5.5 | 5.6
satellite_with_embedded_oracle5.5
spacewalk-java2.0.2
spacewalk-java< 0:1.7.54-131.el5sat | < 0:2.0.2-90.el5sat | < 0:1.7.54-131.el6sat | < 0:2.0.2-90.el6sat
spacewalk-java-config< 0:1.7.54-131.el5sat | < 0:2.0.2-90.el5sat | < 0:1.7.54-131.el6sat | < 0:2.0.2-90.el6sat