CVE-2022-43754: low-severity vulnerability in SUSE Linux Enterprise Module for SUSE Manager…
SUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.do
Published · Updated
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.6epss 0.4%
exploitation probability
0.4%top 64% of all CVEs
observed exploitation
nono source reports it
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected products
SUSE · SUSE Linux Enterprise Module for SUSE Manager Server 4.2SUSE · SUSE Linux Enterprise Module for SUSE Manager Server 4.3SUSE · SUSE Manager Server 4.2Related CVEs — SUSE Linux Enterprise Module for SUSE Manager…
In the same product, most dangerous first.
CVE-2022-21952HIGHSUMA unauthenticated remote DoS via resource exhaustionEPSS 1.5%CVE-2022-31248MEDIUMSUMA user enumeration via weak error messageEPSS 1.0%CVE-2022-43753MEDIUMSUMA/UYUNI arbitrary file disclosure vulnerability in ScapResultDownloadEPSS 0.8%CVE-2022-31255MEDIUMSUMA/UYUNI directory path traversal vulnerability in CobblerSnipperViewActionEPSS 0.8%