Lucene search

RedhatCVE-2016-2104

HistoryApr 13, 2017 - 2:59 p.m.

CVE-2016-2104

2017-04-1314:59:01

CWE-79

redhat

web.nvd.nist.gov

cve-2016-2104

cross-site scripting

xss

red hat satellite 5

remote attackers

arbitrary web script

html

admin panel

input tags

bean message tags

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

50.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the label parameter to admin/BunchDetail.do; (2) the package_name, (3) search_subscribed_channels, or (4) channel_filter parameter to software/packages/NameOverview.do; or unspecified vectors related to (5) <input:hidden> or (6) <bean:message> tags.

Affected configurations

Nvd

Node

redhatsatelliteMatch5.7

VendorProductVersionCPE
redhatsatellite5.7cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	satellite	5.7	cpe:2.3:a:redhat:satellite:5.7:::::::*

References

rhn.redhat.com/errata/RHSA-2016-0590.html

bugzilla.redhat.com/show_bug.cgi?id=1305677

bugzilla.redhat.com/show_bug.cgi?id=1313515

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

50.8%

JSON

Related for CVE-2016-2104