CVE-2015-0284

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-04-14 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.

Affected products

Red Hat Satellite 6: 5.7
RedHat Spacewalk-Java: all versions

References

http://rhn.redhat.com/errata/RHSA-2016-0590.html
https://bugzilla.redhat.com/show_bug.cgi?id=1181152
https://bugzilla.redhat.com/show_bug.cgi?id=1181472
https://bugzilla.redhat.com/show_bug.cgi?id=1314906
https://bugzilla.redhat.com/show_bug.cgi?id=1315398
https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744
https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794
http://rhn.redhat.com/errata/RHSA-2016-0590.html
https://bugzilla.redhat.com/show_bug.cgi?id=1181152
https://bugzilla.redhat.com/show_bug.cgi?id=1181472
https://bugzilla.redhat.com/show_bug.cgi?id=1314906
https://bugzilla.redhat.com/show_bug.cgi?id=1315398

Get alerted when CVE-2015-0284 or the next vulnerability affects your stack