CVE-2011-4346
Satellite: xss in custom system information key handling
- State
- Published
- Severity
- 4.6 Medium
- Published
- Dec 10, 2011
- Updated
- Oct 30, 2026
- Reserved
- Nov 4, 2011
Description
Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.6 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | redhat |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Red Hat Network Satellite Server v 5.4Red Hat |
|
Red Hat Satellite 6Red Hat | |
Red Hat Satellite 6Red Hat |
References
- http://secunia.com/advisories/47162
- http://www.redhat.com/support/errata/RHSA-2011-1794.html
- http://www.securityfocus.com/bid/50963
- http://www.securitytracker.com/id?1026391
- RHSA-2011:1794vendor-advisory
- https://access.redhat.com/security/cve/CVE-2011-4346vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=742050
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.