Read the docs
TI-2013-03870 Aliases CVE-2013-4415GHSA-fch3-m8r7-wg82

Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network…

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) whereCriteria variable in a software channels search; (2) end_year, (3) start_hour, (4) end_am_pm, (5) end_day, (6) end_hour, (7) end_minute, (8) end_month, (9) end_year, (10) optionScanDateSearch, (11) result_filter, (12) search_string, (13) show_as, (14) start_am_pm, (15) start_day, (16) start_hour, (17) start_minute, (18) start_month, (19) start_year, or (20) whereToSearch variable in an scap audit results search; (21) end_minute, (22) end_month, (23) end_year, (24) errata_type_bug, (25) errata_type_enhancement, (26) errata_type_security, (27) fineGrained, (28) list_1892635924_sortdir, (29) optionIssueDateSearch, (30) start_am_pm, (31) start_day, (32) start_hour, (33) start_minute, (34) start_month, (35) start_year, or (36) view_mode variable in an errata search; or (37) fineGrained variable in a systems search, related to PAGE_SIZE_LABEL_SELECTED.

Why it matters now

EPSS 0.01732 77th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*5.6VulnerableRed Hat
cpe:2.3:a:redhat:satellite_5_managed_db:5.6:*:*:*:*:*:*:*5.6VulnerableRed Hat
cpe:2.3:a:redhat:spacewalk-java:*:*:*:*:*:*:*:*before 2.0.2VulnerableRed Hat
cpe:2.3:a:redhat:spacewalk-web:*:*:*:*:*:*:*:*before 2.0.3VulnerableRed Hat
cpe:2.3:a:suse:manager:1.7:*:*:*:*:*:*:*1.7VulnerableSUSE
  • cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:* Versions 5.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite_5_managed_db:5.6:*:*:*:*:*:*:* Versions 5.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:spacewalk-java:*:*:*:*:*:*:*:* Versions before 2.0.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:spacewalk-web:*:*:*:*:*:*:*:* Versions before 2.0.3 Vulnerable ·Red Hat
  • cpe:2.3:a:suse:manager:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·SUSE

Remediation

Red Hat 1 advisory

  • RHSA-2014:0148 Released 2014-02-10 · Red Hat rating Moderate
    spacewalk-java, spacewalk-web and satellite-branding security update
    • Red Hat Satellite 5.6 (RHEL v.5) satellite-branding-5.6.0.23-1.el5sat, spacewalk-base-2.0.3-19.el5sat, spacewalk-base-minimal-2.0.3-19.el5sat +13
    • Red Hat Satellite 5.6 (RHEL v.6) satellite-branding-5.6.0.23-1.el6sat, spacewalk-base-2.0.3-19.el6sat, spacewalk-base-minimal-2.0.3-19.el6sat +13
    • Red Hat Satellite Managed DB 5.6 (RHEL v.5) spacewalk-base-minimal-2.0.3-19.el5sat, spacewalk-dobby-2.0.3-19.el5sat, spacewalk-web-2.0.3-19.el5sat
    • Red Hat Satellite Managed DB 5.6 (RHEL v.6) spacewalk-base-minimal-2.0.3-19.el6sat, spacewalk-dobby-2.0.3-19.el6sat, spacewalk-web-2.0.3-19.el6sat

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 5.6 (RHEL v.5)Fixed RHSA-2014:0148
Red Hat Satellite 5.6 (RHEL v.6)Fixed RHSA-2014:0148
Red Hat Satellite Managed DB 5.6 (RHEL v.5)Fixed RHSA-2014:0148
Red Hat Satellite Managed DB 5.6 (RHEL v.6)Fixed RHSA-2014:0148

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4415
  2. 2026-10-03 Alias added: GHSA-fch3-m8r7-wg82

References

Patch 1

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences