Cross-site scripting in Uyuni - CVE-2022-43754
Published: November 7, 2022
Vulnerability identifier: #VU69064
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2022-43754
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
Uyuni
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
inter-server-sync
inter-server-sync-debuginfo
locale-formula
hub-xmlrpc-api
python3-urlgrabber
release-notes-susemanager-proxy
release-notes-susemanager
spacewalk-utils
spacewalk-utils-extras
spacecmd
spacewalk-client-tools
python3-spacewalk-client-tools
susemanager-schema
spacewalk-backend
spacewalk-backend-xmlrpc
spacewalk-backend-xml-export-libs
spacewalk-backend-tools
spacewalk-backend-sql-postgresql
spacewalk-backend-sql
spacewalk-backend-server
spacewalk-backend-package-push-server
spacewalk-backend-iss-export
spacewalk-backend-iss
spacewalk-backend-config-files-tool
spacewalk-backend-config-files-common
spacewalk-backend-config-files
spacewalk-backend-applet
spacewalk-backend-app
susemanager-sls
uyuni-config-modules
spacewalk-base
spacewalk-base-minimal
spacewalk-base-minimal-config
spacewalk-html
susemanager
susemanager-tools
spacewalk-java-lib
spacewalk-java
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-config
susemanager-docs_en
susemanager-docs_en-pdf
susemanager-doc-indexes
py27-compat-salt
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
inter-server-sync
inter-server-sync-debuginfo
locale-formula
hub-xmlrpc-api
python3-urlgrabber
release-notes-susemanager-proxy
release-notes-susemanager
spacewalk-utils
spacewalk-utils-extras
spacecmd
spacewalk-client-tools
python3-spacewalk-client-tools
susemanager-schema
spacewalk-backend
spacewalk-backend-xmlrpc
spacewalk-backend-xml-export-libs
spacewalk-backend-tools
spacewalk-backend-sql-postgresql
spacewalk-backend-sql
spacewalk-backend-server
spacewalk-backend-package-push-server
spacewalk-backend-iss-export
spacewalk-backend-iss
spacewalk-backend-config-files-tool
spacewalk-backend-config-files-common
spacewalk-backend-config-files
spacewalk-backend-applet
spacewalk-backend-app
susemanager-sls
uyuni-config-modules
spacewalk-base
spacewalk-base-minimal
spacewalk-base-minimal-config
spacewalk-html
susemanager
susemanager-tools
spacewalk-java-lib
spacewalk-java
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-config
susemanager-docs_en
susemanager-docs_en-pdf
susemanager-doc-indexes
py27-compat-salt
How to mitigate CVE-2022-43754
Install updates from vendor's website.
Uyuni - update to 2022.10
inter-server-sync - update to 0.2.4-150300.8.25.2
inter-server-sync-debuginfo - update to 0.2.4-150300.8.25.2
locale-formula - update to 0.3-150300.3.3.2
hub-xmlrpc-api - update to 0.7-150300.3.9.2
python3-urlgrabber - update to 3.10.2.1py2_3-150300.3.3.2
release-notes-susemanager-proxy - update to 4.2.10-150300.3.46.1
release-notes-susemanager - update to 4.2.10-150300.3.57.1
spacewalk-utils - update to 4.2.18-150300.3.21.2
spacewalk-utils-extras - update to 4.2.18-150300.3.21.2
spacecmd - update to 4.2.20-150300.4.30.2
spacewalk-client-tools - update to 4.2.21-150300.4.27.3
python3-spacewalk-client-tools - update to 4.2.21-150300.4.27.3
susemanager-schema - update to 4.2.25-150300.3.30.3
spacewalk-backend - update to 4.2.25-150300.4.32.4
spacewalk-backend-xmlrpc - update to 4.2.25-150300.4.32.4
spacewalk-backend-xml-export-libs - update to 4.2.25-150300.4.32.4
spacewalk-backend-tools - update to 4.2.25-150300.4.32.4
spacewalk-backend-sql-postgresql - update to 4.2.25-150300.4.32.4
spacewalk-backend-sql - update to 4.2.25-150300.4.32.4
spacewalk-backend-server - update to 4.2.25-150300.4.32.4
spacewalk-backend-package-push-server - update to 4.2.25-150300.4.32.4
spacewalk-backend-iss-export - update to 4.2.25-150300.4.32.4
spacewalk-backend-iss - update to 4.2.25-150300.4.32.4
spacewalk-backend-config-files-tool - update to 4.2.25-150300.4.32.4
spacewalk-backend-config-files-common - update to 4.2.25-150300.4.32.4
spacewalk-backend-config-files - update to 4.2.25-150300.4.32.4
spacewalk-backend-applet - update to 4.2.25-150300.4.32.4
spacewalk-backend-app - update to 4.2.25-150300.4.32.4
susemanager-sls - update to 4.2.28-150300.3.36.2
uyuni-config-modules - update to 4.2.28-150300.3.36.2
spacewalk-base - update to 4.2.30-150300.3.30.3
spacewalk-base-minimal - update to 4.2.30-150300.3.30.3
spacewalk-base-minimal-config - update to 4.2.30-150300.3.30.3
spacewalk-html - update to 4.2.30-150300.3.30.3
susemanager - update to 4.2.38-150300.3.44.3
susemanager-tools - update to 4.2.38-150300.3.44.3
spacewalk-java-lib - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-java - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-taskomatic - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-java-postgresql - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-java-config - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
susemanager-docs_en - update to 4.2-150300.12.36.2
susemanager-docs_en-pdf - update to 4.2-150300.12.36.2
susemanager-doc-indexes - update to 4.2-150300.12.36.3
py27-compat-salt - update to 3000.3-150300.7.7.26.2
inter-server-sync - update to 0.2.4-150300.8.25.2
inter-server-sync-debuginfo - update to 0.2.4-150300.8.25.2
locale-formula - update to 0.3-150300.3.3.2
hub-xmlrpc-api - update to 0.7-150300.3.9.2
python3-urlgrabber - update to 3.10.2.1py2_3-150300.3.3.2
release-notes-susemanager-proxy - update to 4.2.10-150300.3.46.1
release-notes-susemanager - update to 4.2.10-150300.3.57.1
spacewalk-utils - update to 4.2.18-150300.3.21.2
spacewalk-utils-extras - update to 4.2.18-150300.3.21.2
spacecmd - update to 4.2.20-150300.4.30.2
spacewalk-client-tools - update to 4.2.21-150300.4.27.3
python3-spacewalk-client-tools - update to 4.2.21-150300.4.27.3
susemanager-schema - update to 4.2.25-150300.3.30.3
spacewalk-backend - update to 4.2.25-150300.4.32.4
spacewalk-backend-xmlrpc - update to 4.2.25-150300.4.32.4
spacewalk-backend-xml-export-libs - update to 4.2.25-150300.4.32.4
spacewalk-backend-tools - update to 4.2.25-150300.4.32.4
spacewalk-backend-sql-postgresql - update to 4.2.25-150300.4.32.4
spacewalk-backend-sql - update to 4.2.25-150300.4.32.4
spacewalk-backend-server - update to 4.2.25-150300.4.32.4
spacewalk-backend-package-push-server - update to 4.2.25-150300.4.32.4
spacewalk-backend-iss-export - update to 4.2.25-150300.4.32.4
spacewalk-backend-iss - update to 4.2.25-150300.4.32.4
spacewalk-backend-config-files-tool - update to 4.2.25-150300.4.32.4
spacewalk-backend-config-files-common - update to 4.2.25-150300.4.32.4
spacewalk-backend-config-files - update to 4.2.25-150300.4.32.4
spacewalk-backend-applet - update to 4.2.25-150300.4.32.4
spacewalk-backend-app - update to 4.2.25-150300.4.32.4
susemanager-sls - update to 4.2.28-150300.3.36.2
uyuni-config-modules - update to 4.2.28-150300.3.36.2
spacewalk-base - update to 4.2.30-150300.3.30.3
spacewalk-base-minimal - update to 4.2.30-150300.3.30.3
spacewalk-base-minimal-config - update to 4.2.30-150300.3.30.3
spacewalk-html - update to 4.2.30-150300.3.30.3
susemanager - update to 4.2.38-150300.3.44.3
susemanager-tools - update to 4.2.38-150300.3.44.3
spacewalk-java-lib - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-java - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-taskomatic - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-java-postgresql - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
spacewalk-java-config - addressed in versions 4.2.43-150300.3.48.2, 4.3.39-150400.3.11.1
susemanager-docs_en - update to 4.2-150300.12.36.2
susemanager-docs_en-pdf - update to 4.2-150300.12.36.2
susemanager-doc-indexes - update to 4.2-150300.12.36.3
py27-compat-salt - update to 3000.3-150300.7.7.26.2