CVE-2011-3344

A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session.

CVSS v3 5.4 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.redhat.com/support/errata/RHSA-2011-1299.html	Patch Vendor Advisory
https://access.redhat.com/errata/RHSA-2011:1299
https://access.redhat.com/security/cve/CVE-2011-3344
https://bugzilla.redhat.com/show_bug.cgi?id=731647	Vendor Advisory
https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=890781d7ec983e32fe83af2f7c033d087292851f
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2011-1299.html	Patch Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=731647	Vendor Advisory
https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=890781d7ec983e32fe83af2f7c033d087292851f
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:network_satellite:-:::::::*
	cpe:2.3:a:redhat:spacewalk:1.6:::::::*

History

30 Oct 2026, 19:17

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2011:1299 -

Information

Published : 2014-02-05 18:55

Updated : 2026-10-30 19:17

NVD link : CVE-2011-3344

Mitre link : CVE-2011-3344

CVE.ORG link : CVE-2011-3344

JSON object : View

Products Affected

redhat

network_satellite
spacewalk

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2011-3344", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:network_satellite:5.4::el5", "cpe:/a:redhat:network_satellite:5.4::el6"], "vendor": "Red Hat", "product": "Red Hat Network Satellite Server v 5.4", "versions": [{"status": "unaffected", "version": "0:1.2.2-7.el5sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "spacewalk-config", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:network_satellite:5.4::el5", "cpe:/a:redhat:network_satellite:5.4::el6"], "vendor": "Red Hat", "product": "Red Hat Network Satellite Server v 5.4", "versions": [{"status": "unaffected", "version": "0:1.2.39-98.el5sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "spacewalk-java", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:network_satellite:5.4::el5", "cpe:/a:redhat:network_satellite:5.4::el6"], "vendor": "Red Hat", "product": "Red Hat Network Satellite Server v 5.4", "versions": [{"status": "unaffected", "version": "0:1.2.7-20.el5sat", "lessThan": "*", "versionType": "rpm"}], "packageName": "spacewalk-web", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "rhn-client-tools", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "rhnsd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "yum-rhn-plugin", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "rhnsd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "yum-rhn-plugin", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}]}], "published": "2014-02-05T18:55:06.113", "references": [{"url": "http://www.redhat.com/support/errata/RHSA-2011-1299.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2011:1299", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2011-3344", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=731647", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=890781d7ec983e32fe83af2f7c033d087292851f", "source": "secalert@redhat.com"}, {"url": "https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-1299.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=731647", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=890781d7ec983e32fe83af2f7c033d087292851f", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session."}, {"lang": "es", "value": "Vulnerabilidad de XSS en el formulario de recuperaci\u00f3n de usuario/contrase\u00f1a en Spacewalk 1.6, utilizado en Red Hat Network (RHN) Satellite, permite a atacantes remotos inyectar script Web arbitrario o HTML a trav\u00e9s de la URL."}], "lastModified": "2026-10-30T19:17:24.983", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:network_satellite:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "181F4E02-1FFA-4EFD-9DBF-3E23EFC200AE"}, {"criteria": "cpe:2.3:a:redhat:spacewalk:1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F66E06D8-78D7-492A-992C-8A70B5C36A97"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}