CVE-2022-43754: fallo de gravedad baja en SUSE Linux Enterprise Module for SUSE Manager…
SUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.do
Publicada el · Actualizada el
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.6epss 0.4%
probabilidad de explotación
0.4%top 64% de las CVE
explotación observada
noninguna fuente lo reporta
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Productos afectados
SUSE · SUSE Linux Enterprise Module for SUSE Manager Server 4.2SUSE · SUSE Linux Enterprise Module for SUSE Manager Server 4.3SUSE · SUSE Manager Server 4.2CVEs relacionadas — SUSE Linux Enterprise Module for SUSE Manager…
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-21952HIGHSUMA unauthenticated remote DoS via resource exhaustionEPSS 1.5%CVE-2022-31248MEDIUMSUMA user enumeration via weak error messageEPSS 1.0%CVE-2022-43753MEDIUMSUMA/UYUNI arbitrary file disclosure vulnerability in ScapResultDownloadEPSS 0.8%CVE-2022-31255MEDIUMSUMA/UYUNI directory path traversal vulnerability in CobblerSnipperViewActionEPSS 0.8%