CVE-2011-3344: Spacewalk: spacewalk: cross-site scripting via uri in lookup login/password form

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-02-05 · updated 2026-06-16
Weakness: CWE-79

Description

A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session.

Affected products

RedHat Network Satellite: all versions
spacewalkproject spacewalk: 1.6

References

http://www.redhat.com/support/errata/RHSA-2011-1299.html
https://access.redhat.com/security/cve/CVE-2011-3344
https://bugzilla.redhat.com/show_bug.cgi?id=731647
https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=890781d7ec983e32fe83af2f7c033d087292851f
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html
http://www.redhat.com/support/errata/RHSA-2011-1299.html
https://bugzilla.redhat.com/show_bug.cgi?id=731647
https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=890781d7ec983e32fe83af2f7c033d087292851f
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html

Get alerted when CVE-2011-3344 or the next vulnerability affects your stack