Lucene search

[email protected]CVE-2022-43754

HistoryNov 10, 2022 - 3:15 p.m.

CVE-2022-43754

2022-11-1015:15:19

CWE-79

[email protected]

web.nvd.nist.gov

cve-2022-43754

suse linux enterprise

suse manager

cross-site scripting

input neutralization

security vulnerability

remote attack

javascript embedding

package versions

nvd

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.3%

JSON

An Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.

Affected configurations

NVD

Node

susemanager_serverRange4.2–4.2.10

susemanager_serverRange4.3–4.3.2

uyuni-projectuyuniRange<2022.10

CPENameOperatorVersion
suse:manager_serversuse manager serverlt4.2.10
suse:manager_serversuse manager serverlt4.3.2
uyuni-project:uyuniuyuni-project uyunilt2022.10

CPE	Name	Operator	Version
suse:manager_server	suse manager server	lt	4.2.10
suse:manager_server	suse manager server	lt	4.3.2
uyuni-project:uyuni	uyuni-project uyuni	lt	2022.10

CNA Affected

[
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Module for SUSE Manager Server 4.2",
    "versions": [
      {
        "version": "hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls",
        "status": "affected",
        "lessThan": "4.2.28",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Module for SUSE Manager Server 4.3",
    "versions": [
      {
        "version": "spacewalk-java",
        "status": "affected",
        "lessThan": "4.3.39",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "SUSE",
    "product": "SUSE Manager Server 4.2",
    "versions": [
      {
        "version": "release-notes-susemanager",
        "status": "affected",
        "lessThan": "4.2.10",
        "versionType": "custom"
      }
    ]
  }
]

References

bugzilla.suse.com/show_bug.cgi?id=1204741

Social References