SUSE update for SUSE Manager Client Tools

1) Cross-site scripting

EUVDB-ID: #VU79294

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-3978

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Update the affected package SUSE Manager Client Tools to the latest version.

Vulnerable software versions

SUSE Manager Client Tools for SLE: 12

SUSE Linux Enterprise Server for the Raspberry Pi: 12-SP2

SUSE Linux Enterprise Desktop 12: SP1 - SP4

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

SUSE Linux Enterprise Desktop: 12-SP5

python2-spacewalk-client-tools: before 4.3.21-52.104.2

spacewalk-check: before 4.3.21-52.104.2

mgrctl-bash-completion: before 0.1.23-1.13.2

mgr-daemon: before 4.3.11-1.53.2

spacewalk-client-setup: before 4.3.21-52.104.2

python2-spacewalk-check: before 4.3.21-52.104.2

spacewalk-client-tools: before 4.3.21-52.104.2

mgrctl-zsh-completion: before 0.1.23-1.13.2

spacecmd: before 5.0.10-38.150.2

python2-spacewalk-client-setup: before 4.3.21-52.104.2

python2-uyuni-common-libs: before 5.0.5-1.45.2

mgrctl-debuginfo: before 0.1.23-1.13.2

golang-github-prometheus-promu: before 0.16.0-1.21.3

mgrctl: before 0.1.23-1.13.2

golang-github-lusitaniae-apache_exporter: before 1.0.8-1.24.3

CPE2.3

• cpe:2.3:o:suse:suse_manager_client_tools_for_sle:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_the_raspberry_pi:12-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop_12:SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop_12:SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop_12:SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:12-SP5:*:*:*:*:*:*:*
• cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:mgrctl-bash-completion:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:mgrctl-zsh-completion:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:mgrctl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:golang-github-prometheus-promu:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:mgrctl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:golang-github-lusitaniae-apache_exporter:*:*:*:*:*:suse_linux:*:*

External links

http://www.suse.com/support/update/announcement/2024/suse-su-20244010-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.