Every CVE Search/ Get API key

CVE-2025-53883

spacewalk-java has various XSS issues on search page

9.3 CriticalFix available

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.29%Up 0.2 points since Oct 30, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.3

spacewalk-java has various XSS issues on search page

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.

Record
CVE-2025-53883
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-80
Updated
2026-11-02
EUVDEUVD-2025-36996 9.3

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.

Record
EUVD-2025-36996
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-h2fm-479p-v37r 9.3

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability...

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.

Record
GHSA-h2fm-479p-v37r
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-80
Updated
2026-11-02
NVD 9.3

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.

Record
CVE-2025-53883
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-80
Updated
2026-11-02
OSVSUSE-SU-2025:3826-1 No score

Security update 4.3.16.1 for SUSE Manager Server 4.3 LTS

This update fixes the following issues:

susemanager-build-keys:

  • Update SUSE GPG key and make it available for Salt (bsc#1250911)

susemanager-sls:

  • Version 4.3.50-0
    • Fix OS Family grain name (bsc#1250911)
  • Version 4.3.49-0
    • Fixed syntax error in Salt state
  • Version 4.3.48-0
    • Automatically deploy the SUSE GPG key (bsc#1250911)

spacewalk-java:

  • Version 4.3.88-0 with security fix:
    • CVE-2025-53883: Escape input strings in system search form (bsc#1246439)

rhnlib:

  • Version 4.3.7-0:
    • Use more secure defusedxml parser (bsc#1227577)

spacewalk-backend:

  • Version 4.3.34-0:
    • Use more secure defusedxml parser (bsc#1227577)

spacewalk-web:

  • Version 4.3.46-0:
    • Bumped the WebUI version to 4.3.16.1

How to apply this update:

  1. Log in as root user to the Multi-Linux Manager Server.
  2. Stop the Spacewalk service: spacewalk-service stop
  3. Apply the patch using either zypper patch or YaST Online Update.
  4. Start the Spacewalk service: spacewalk-service start
Record
SUSE-SU-2025:3826-1
Updated
2026-11-02
OSVSUSE-SU-2025:3827-1 No score

Security update 4.3.16.1 for SUSE Manager Server Release Notes

This update fixes the following issues:

release-notes-susemanager:

  • Update to SUSE Manager 4.3.16.1
    • CVEs Fixed: CVE-2025-53883, CVE-2025-53880, CVE-2025-53192
    • Bugs mentioned: bsc#1246439, bsc#1246277, bsc#1248252
Record
SUSE-SU-2025:3827-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rhnlib
SUSE:Manager Proxy LTS 4.3
 before 4.3.7-150400.3.9.4
4.3.7-150400.3.9.4
spacewalk-backend
SUSE:Manager Proxy LTS 4.3
 before 4.3.34-150400.3.58.6
4.3.34-150400.3.58.6
spacewalk-web
SUSE:Manager Proxy LTS 4.3
 before 4.3.46-150400.3.63.5
4.3.46-150400.3.63.5
susemanager-build-keys
SUSE:Manager Proxy LTS 4.3
 before 15.4.11-150400.3.38.1
15.4.11-150400.3.38.1
susemanager-tftpsync-recv
SUSE:Manager Proxy LTS 4.3
 before 4.3.11-150400.3.15.3
4.3.11-150400.3.15.3
rhnlib
SUSE:Manager Server LTS 4.3
 before 4.3.7-150400.3.9.4
4.3.7-150400.3.9.4
spacewalk-backend
SUSE:Manager Server LTS 4.3
 before 4.3.34-150400.3.58.6
4.3.34-150400.3.58.6
spacewalk-java
SUSE:Manager Server LTS 4.3
 before 4.3.88-150400.3.113.5
4.3.88-150400.3.113.5
spacewalk-web
SUSE:Manager Server LTS 4.3
 before 4.3.46-150400.3.63.5
4.3.46-150400.3.63.5
susemanager-build-keys
SUSE:Manager Server LTS 4.3
 before 15.4.11-150400.3.38.1
15.4.11-150400.3.38.1
susemanager-sls
SUSE:Manager Server LTS 4.3
 before 4.3.50-150400.3.68.1
4.3.50-150400.3.68.1
release-notes-susemanager-proxy
SUSE:Manager Proxy LTS 4.3
From an advisory covering 3 CVEs
 before 4.3.16.1-150400.3.101.2
4.3.16.1-150400.3.101.2
release-notes-susemanager
SUSE:Manager Server LTS 4.3
From an advisory covering 3 CVEs
 before 4.3.16.1-150400.3.143.2
4.3.16.1-150400.3.143.2

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-53883 is a critical vulnerability (CVSS 9.3) in Suse Manager Server Lts 4.3, published October 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. Fixed in rhnlib 4.3.7-150400.3.9.4.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open