CVE-2016-3079 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2016-3079 Interim 1 9 2023-02-13T02:22:21Z current 2021-05-30T13:40:20Z 2023-02-13T02:22:21Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2016-3079 Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to systems/SystemEntitlements.do; (2) the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a (3) snapshot tag or (4) system group in System Set Manager (SSM). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2016-May/002076.html E-Mail link for SUSE-SU-2016:1367-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Manager 2.1 cobbler-2.2.2-0.61.2 osa-dispatcher-5.11.33.11-15.2 rhnlib-2.5.69.8-11.2 spacewalk-backend-2.1.55.25-24.5 spacewalk-backend-app-2.1.55.25-24.5 spacewalk-backend-applet-2.1.55.25-24.5 spacewalk-backend-config-files-2.1.55.25-24.5 spacewalk-backend-config-files-common-2.1.55.25-24.5 spacewalk-backend-config-files-tool-2.1.55.25-24.5 spacewalk-backend-iss-2.1.55.25-24.5 spacewalk-backend-iss-export-2.1.55.25-24.5 spacewalk-backend-libs-2.1.55.25-24.5 spacewalk-backend-package-push-server-2.1.55.25-24.5 spacewalk-backend-server-2.1.55.25-24.5 spacewalk-backend-sql-2.1.55.25-24.5 spacewalk-backend-sql-oracle-2.1.55.25-24.5 spacewalk-backend-sql-postgresql-2.1.55.25-24.5 spacewalk-backend-tools-2.1.55.25-24.5 spacewalk-backend-xml-export-libs-2.1.55.25-24.5 spacewalk-backend-xmlrpc-2.1.55.25-24.5 spacewalk-branding-2.1.33.16-18.2 spacewalk-certs-tools-2.1.6.10-18.3 spacewalk-java-2.1.165.23-20.1 spacewalk-java-config-2.1.165.23-20.1 spacewalk-java-lib-2.1.165.23-20.1 spacewalk-java-oracle-2.1.165.23-20.1 spacewalk-java-postgresql-2.1.165.23-20.1 spacewalk-taskomatic-2.1.165.23-20.1 spacewalk-utils-2.1.27.15-12.7 suseRegisterInfo-2.1.12-14.2 susemanager-2.1.24-23.1 susemanager-sync-data-2.1.15-30.2 susemanager-tftpsync-2.1.2-11.2 susemanager-tools-2.1.24-23.1 cobbler-2.2.2-0.61.2 as a component of SUSE Manager 2.1 osa-dispatcher-5.11.33.11-15.2 as a component of SUSE Manager 2.1 rhnlib-2.5.69.8-11.2 as a component of SUSE Manager 2.1 spacewalk-backend-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-app-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-applet-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-config-files-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-config-files-common-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-config-files-tool-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-iss-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-iss-export-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-libs-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-package-push-server-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-server-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-sql-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-sql-oracle-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-sql-postgresql-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-tools-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-xml-export-libs-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-backend-xmlrpc-2.1.55.25-24.5 as a component of SUSE Manager 2.1 spacewalk-branding-2.1.33.16-18.2 as a component of SUSE Manager 2.1 spacewalk-certs-tools-2.1.6.10-18.3 as a component of SUSE Manager 2.1 spacewalk-java-2.1.165.23-20.1 as a component of SUSE Manager 2.1 spacewalk-java-config-2.1.165.23-20.1 as a component of SUSE Manager 2.1 spacewalk-java-lib-2.1.165.23-20.1 as a component of SUSE Manager 2.1 spacewalk-java-oracle-2.1.165.23-20.1 as a component of SUSE Manager 2.1 spacewalk-java-postgresql-2.1.165.23-20.1 as a component of SUSE Manager 2.1 spacewalk-taskomatic-2.1.165.23-20.1 as a component of SUSE Manager 2.1 spacewalk-utils-2.1.27.15-12.7 as a component of SUSE Manager 2.1 suseRegisterInfo-2.1.12-14.2 as a component of SUSE Manager 2.1 susemanager-2.1.24-23.1 as a component of SUSE Manager 2.1 susemanager-sync-data-2.1.15-30.2 as a component of SUSE Manager 2.1 susemanager-tftpsync-2.1.2-11.2 as a component of SUSE Manager 2.1 susemanager-tools-2.1.24-23.1 as a component of SUSE Manager 2.1 Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to systems/SystemEntitlements.do; (2) the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a (3) snapshot tag or (4) system group in System Set Manager (SSM). CVE-2016-3079 SUSE Manager 2.1:cobbler-2.2.2-0.61.2 SUSE Manager 2.1:osa-dispatcher-5.11.33.11-15.2 SUSE Manager 2.1:rhnlib-2.5.69.8-11.2 SUSE Manager 2.1:spacewalk-backend-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-app-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-applet-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-config-files-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-config-files-common-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-config-files-tool-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-iss-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-iss-export-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-libs-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-package-push-server-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-server-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-sql-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-sql-oracle-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-sql-postgresql-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-tools-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-xml-export-libs-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-backend-xmlrpc-2.1.55.25-24.5 SUSE Manager 2.1:spacewalk-branding-2.1.33.16-18.2 SUSE Manager 2.1:spacewalk-certs-tools-2.1.6.10-18.3 SUSE Manager 2.1:spacewalk-java-2.1.165.23-20.1 SUSE Manager 2.1:spacewalk-java-config-2.1.165.23-20.1 SUSE Manager 2.1:spacewalk-java-lib-2.1.165.23-20.1 SUSE Manager 2.1:spacewalk-java-oracle-2.1.165.23-20.1 SUSE Manager 2.1:spacewalk-java-postgresql-2.1.165.23-20.1 SUSE Manager 2.1:spacewalk-taskomatic-2.1.165.23-20.1 SUSE Manager 2.1:spacewalk-utils-2.1.27.15-12.7 SUSE Manager 2.1:suseRegisterInfo-2.1.12-14.2 SUSE Manager 2.1:susemanager-2.1.24-23.1 SUSE Manager 2.1:susemanager-sync-data-2.1.15-30.2 SUSE Manager 2.1:susemanager-tftpsync-2.1.2-11.2 SUSE Manager 2.1:susemanager-tools-2.1.24-23.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N