Every CVE Search/ Get API key

CVE-2025-23393

Reflected XSS in spacewalk-java

5.6 Medium

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in  spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
Active

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.36%Up 0.3 points since May 27, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.6

Reflected XSS in spacewalk-java

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in  spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3.

Record
CVE-2025-23393
CVSS 4.0
5.6 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.2 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
EUVDEUVD-2025-27709 5.6

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in  spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3.

Record
EUVD-2025-27709
CVSS 4.0
5.6 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-fg78-v6qm-37gm 5.7

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ...

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in  spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3.

Record
GHSA-fg78-v6qm-37gm
CVSS 4.0
5.7 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.2 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
NVD 5.7

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in  spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3.

Record
CVE-2025-23393
CVSS 4.0
5.7 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.2 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
Weakness
CWE-80
Updated
2026-11-02
OSVSUSE-SU-2025:02475-1 No score

Security update 4.3.16 for Multi-Linux Manager Server

This update fixes the following issues:

cobbler:

  • Prevent crash during Cobbler startup on NFS environments (bsc#1240666)
  • Synchronize cobbler add and sync actions (bsc#1233371)
  • Exclude disabled profiles from buildiso gen (bsc#1230908)

grafana-formula:

  • Version 4.3.0:
    • Added SUSE Linux Enterprise Server 15 SP7 to the supported versions (bsc#1245368)
    • Dropped old unsupported SUSE versions from the supported versions list
    • Migrated from deprecated Graph panels to new timeseries panels

inter-server-sync:

  • Version 0.3.7-0:
    • Added SSL signed export and import validation (bsc#1241239)
  • Version 0.3.6-0:
    • Included /var/log/hub (bsc#1243724)

spacecmd:

  • Version 4.3.31-0:
    • Improved translation update process

spacewalk-admin:

  • Version 4.3.33-0
    • Security issues fixed:
      • CVE-2025-46809: Do not expose HTTP Proxy password when breaking URL format (bsc#1245005)
    • Other bugs fixed:
      • Enhance permissions for reposync zypper cache
  • Version 4.3.14-0:
    • Added support for environment variables in rhn-config-satellite (bsc#1242148)
    • mgr-monitoring-ctl: avoid possible errors due to non-ascii characters (bsc#1242030)

spacewalk-backend:

  • Version 4.3.32-0
    • Removed python3-simplejson use in spacewalk-repo-sync (bsc#1236635)
    • Improved translation update process
    • Make reposync allow commas as part of HTTP Proxy password (bsc#1243460)
    • Removed bootloader linux and initrd files from spacewalk-debug
    • Use libzypp's Curl2 backend during reposync (bsc#1245222)

spacewalk-client-tools:

  • Version 4.3.23-0
    • Improved translation update process

spacewalk-config:

  • Version 4.3.16-0
    • Allow passing environment variables to rhn-config-satellite (bsc#1242148)

spacewalk-java:

  • Version 4.3.87-0
    • Security issues fixed:
      • CVE-2025-46811: Clean up stale sessions on websocket open (bsc#1246119)
  • Version 4.3.86-0:
    • Security issues fixed:
      • CVE-2025-23393: Filter user input in systems list page (bsc#1240386)
    • Other bugs fixed:
      • Fixed tooltip text for icons in the patches list (bsc#1234608)
      • Fixed openscap audit is running immediately even when scheduled for next days (bsc#1239743)
      • Adds calling a highstate in the API for actionchain (bsc#1157520)
      • Fixed behavior of reboot_suggested or restart_suggested by API (bsc#1236910)
      • Fixed action chain scheduled within SSM creates no link for the new action chain (bsc#1243825)
      • Fixed severity levels missing in API output of errata.getDetails (bsc#1240038)
      • Fixed internal server error when accessing groups in activation keys (bsc#1237581)
      • Fixed http_proxy_password stored as clear text in /var/log/messages (bsc#1242148)
      • Fixed manage errors in user-defined pillars (bsc#1230403)
      • In CLM live-patching template form, show kernel versions from base product as well (bsc#1239907)
      • Improved handling of system list filtering (bsc#1242004)
      • Fixed issue preventing OES products from showing up (bsc#1237082)
      • Fixed config channels not following priority in highstate (bsc#1237694)
      • Improved performance when changing channels on multiple system through SSM (bsc#1239154)
      • Fixed package locking for packages not available anymore in the assigned repositories (bsc#1236877)
      • Do not show Vendor Advisory link for SL-Micro 6.0 and 6.1 products (bsc#1237770)
      • Fixed API namespace for AdminPaygHandler
      • Fixed CLM channel name definition (bsc#1239868)
      • Fixed XMLRPC API endpoint updateRepoSsl repository property
      • Fixed API documentation for system config listFiles (bsc#1245027)
      • Fixed inconsistency in task schedule deactivation and add activation capability (bsc#1225740)

spacewalk-utils:

  • Version 4.3.24-0:
    • Removed spacewalk-clone-by-date dependency on python3-simplejson

spacewalk-web:

  • Version 4.3.45-0:
    • Security issues fixed:
      • CVE-2025-23392, CVE-2025-23393: Filter user input in systems list page (bsc#1239826, bsc#1240386)
    • Other…
Record
SUSE-SU-2025:02475-1
Updated
2026-11-02
OSVSUSE-SU-2025:02476-1 No score

Security update 4.3.16 for Multi-Linux Manager Server

This update fixes the following issues:

release-notes-susemanager:

  • Update to SUSE Manager 4.3.16
    • Important Salt Security Update
    • Added support for SUSE Linux Enterprise 15 SP7 as a client using the Salt Bundle
    • CVE Fixed CVE-2025-23392, CVE-2025-23393, CVE-2024-38824, CVE-2025-22239 CVE-2025-22236, CVE-2025-22237, CVE-2024-38825, CVE-2025-22240 CVE-2024-38823, CVE-2025-22241, CVE-2025-22238, CVE-2025-22242 CVE-2024-38822, CVE-2025-46811, CVE-2025-46809
    • Bugs mentioned: bsc#1157520, bsc#1191142, bsc#1209060, bsc#1211373, bsc#1213952 bsc#1216187, bsc#1221031, bsc#1225740, bsc#1230403, bsc#1230908 bsc#1233371, bsc#1234608, bsc#1236635, bsc#1236779, bsc#1236810 bsc#1236877, bsc#1236910, bsc#1237060, bsc#1237082, bsc#1237294 bsc#1237403, bsc#1237581, bsc#1237694, bsc#1237770, bsc#1238922 bsc#1238924, bsc#1239102, bsc#1239154, bsc#1239604, bsc#1239743 bsc#1239826, bsc#1239868, bsc#1239907, bsc#1240038, bsc#1240386 bsc#1240666, bsc#1240842, bsc#1241239, bsc#1241286, bsc#1241455 bsc#1241490, bsc#1242004, bsc#1242030, bsc#1242148, bsc#1242554 bsc#1242911, bsc#1243239, bsc#1243460, bsc#1243724, bsc#1243825 bsc#1244065, bsc#1244290, bsc#1245027, bsc#1245222, bsc#1245368 bsc#1245005, bsc#1246119
Record
SUSE-SU-2025:02476-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
uyuni-proxy-systemd-services
SUSE:Manager Client Tools 15
From an advisory covering 4 CVEs
 before 4.3.16-150000.1.33.1
4.3.16-150000.1.33.1
uyuni-proxy-systemd-services
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 4 CVEs
 before 4.3.16-150000.1.33.1
4.3.16-150000.1.33.1
mgr-daemon
SUSE:Manager Proxy Module 4.3
From an advisory covering 4 CVEs
 before 4.3.12-150400.3.24.2
4.3.12-150400.3.24.2
spacecmd
SUSE:Manager Proxy Module 4.3
From an advisory covering 4 CVEs
 before 4.3.31-150400.3.48.2
4.3.31-150400.3.48.2
spacewalk-backend
SUSE:Manager Proxy Module 4.3
From an advisory covering 4 CVEs
 before 4.3.33-150400.3.55.2
4.3.33-150400.3.55.2
spacewalk-client-tools
SUSE:Manager Proxy Module 4.3
From an advisory covering 4 CVEs
 before 4.3.23-150400.3.39.3
4.3.23-150400.3.39.3
spacewalk-proxy-installer
SUSE:Manager Proxy Module 4.3
From an advisory covering 4 CVEs
 before 4.3.12-150400.3.9.2
4.3.12-150400.3.9.2
spacewalk-web
SUSE:Manager Proxy Module 4.3
From an advisory covering 4 CVEs
 before 4.3.45-150400.3.60.3
4.3.45-150400.3.60.3
supportutils-plugin-susemanager-client
SUSE:Manager Proxy Module 4.3
From an advisory covering 4 CVEs
 before 4.3.5-150400.3.9.2
4.3.5-150400.3.9.2
supportutils-plugin-susemanager-proxy
SUSE:Manager Proxy Module 4.3
From an advisory covering 4 CVEs
 before 4.3.5-150400.3.9.2
4.3.5-150400.3.9.2
Show 24 moreShow less
Affected packages
PackageAffectedFixed
susemanager-build-keys
SUSE:Manager Proxy Module 4.3
From an advisory covering 4 CVEs
 before 15.4.11-150400.3.35.2
15.4.11-150400.3.35.2
susemanager-tftpsync-recv
SUSE:Manager Proxy Module 4.3
From an advisory covering 4 CVEs
 before 4.3.10-150400.3.12.2
4.3.10-150400.3.12.2
uyuni-proxy-systemd-services
SUSE:Manager Proxy Module 4.3
From an advisory covering 4 CVEs
 before 4.3.16-150000.1.33.1
4.3.16-150000.1.33.1
cobbler
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 3.3.3-150400.5.58.3
3.3.3-150400.5.58.3
grafana-formula
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.0-150400.3.24.2
4.3.0-150400.3.24.2
inter-server-sync
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 0.3.7-150400.3.39.4
0.3.7-150400.3.39.4
spacecmd
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.31-150400.3.48.2
4.3.31-150400.3.48.2
spacewalk-admin
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.14-150400.3.15.3
4.3.14-150400.3.15.3
spacewalk-backend
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.33-150400.3.55.2
4.3.33-150400.3.55.2
spacewalk-client-tools
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.23-150400.3.39.3
4.3.23-150400.3.39.3
spacewalk-config
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.16-150400.3.24.2
4.3.16-150400.3.24.2
spacewalk-java
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.87-150400.3.110.2
4.3.87-150400.3.110.2
spacewalk-utils
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.24-150400.3.35.4
4.3.24-150400.3.35.4
spacewalk-web
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.45-150400.3.60.3
4.3.45-150400.3.60.3
subscription-matcher
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 0.40-150400.3.28.2
0.40-150400.3.28.2
supportutils-plugin-susemanager
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.15-150400.3.33.2
4.3.15-150400.3.33.2
susemanager
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.42-150400.3.66.1
4.3.42-150400.3.66.1
susemanager-build-keys
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 15.4.11-150400.3.35.2
15.4.11-150400.3.35.2
susemanager-docs_en
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.16-150400.9.72.2
4.3.16-150400.9.72.2
susemanager-schema
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.29-150400.3.51.2
4.3.29-150400.3.51.2
susemanager-sls
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.47-150400.3.61.4
4.3.47-150400.3.61.4
susemanager-sync-data
SUSE:Manager Server Module 4.3
From an advisory covering 4 CVEs
 before 4.3.24-150400.3.44.2
4.3.24-150400.3.44.2
release-notes-susemanager-proxy
SUSE:Manager Proxy 4.3
From an advisory covering 15 CVEs
 before 4.3.16-150400.3.98.1
4.3.16-150400.3.98.1
release-notes-susemanager
SUSE:Manager Server 4.3
From an advisory covering 15 CVEs
 before 4.3.16-150400.3.140.1
4.3.16-150400.3.140.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-23393 is a medium vulnerability (CVSS 5.6) in Suse Manager Server Module 4.3, published May 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. No source names a fixed version.

References

Show 72 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open