Vulnerability Details : CVE-2012-6149
Multiple cross-site scripting (XSS) vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) subject or (2) content values of a note in a system.addNote XML-RPC call.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2012-6149
Probability of exploitation activity in the next 30 days: 0.12%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 46 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-6149
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST |
CWE ids for CVE-2012-6149
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-6149
-
https://www.suse.com/support/update/announcement/2014/suse-su-20140222-1.html
SUSE-SU-2014:0222-1Vendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=882000
882000 – (CVE-2012-6149) CVE-2012-6149 Satellite, Spacewalk (spacewalk-java): XSS in system.addNote XML-RPC call due improper sanitization of note's subject and contentIssue Tracking;Vendor Advisory
-
https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=1d0f4b4a78ea03d9f2d05fbd52236b1f2ab68e85
Infrastructure/Fedorahosted-retirement - Fedora Project WikiExploit;Patch
-
http://rhn.redhat.com/errata/RHSA-2014-0148.html
RHSA-2014:0148 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13f
Infrastructure/Fedorahosted-retirement - Fedora Project WikiPatch;Third Party Advisory
Products affected by CVE-2012-6149
- cpe:2.3:a:redhat:spacewalk-java:2.0.2-57:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:satellite_5_managed_db:5.6:*:*:*:*:*:*:*