CVE-2011-2920: Spacewalk: spacewalk: cross-site scripting vulnerability allows arbitrary web script execution.

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-02-05 · updated 2026-06-16
Weakness: CWE-79

Description

A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remote attacker to inject arbitrary web script or HTML into web pages through various input fields, such as the "Filter by Synopsis" field. This could lead to the execution of malicious code in a user's web browser, potentially compromising user sessions or disclosing sensitive information.

Affected products

RedHat Network Satellite: all versions
spacewalkproject spacewalk: 1.6

References

http://www.redhat.com/support/errata/RHSA-2011-1299.html
https://access.redhat.com/security/cve/CVE-2011-2920
https://bugzilla.redhat.com/show_bug.cgi?id=681032
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html
http://www.redhat.com/support/errata/RHSA-2011-1299.html
https://bugzilla.redhat.com/show_bug.cgi?id=681032
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html

Get alerted when CVE-2011-2920 or the next vulnerability affects your stack