{"id":"CVE-2011-2919","aliases":["EUVD-2011-2892","GHSA-7vjr-395v-c89g","RHSA-2011:1299"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN)...","description":"Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01188,"percentile":0.68111,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2014-02-05T18:00:00Z","modified":"2026-06-16T23:32:15Z","affected":[{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-base-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.2-7.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-dobby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-grail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.39-98.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-java-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.39-98.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-java-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.39-98.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-java-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.39-98.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-pxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-sniglets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-taskomatic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.39-98.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el5sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-base-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.2-7.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-dobby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-grail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.39-98.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-java-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.39-98.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-java-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.39-98.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-java-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.39-98.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-pxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-sniglets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-taskomatic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.39-98.el6sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-20.el6sat"}]}],"bundled":5}],"products":[{"vendor":"redhat","product":"network_satellite"},{"vendor":"redhat","product":"spacewalk"}],"references":[{"url":"https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1299.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Patch","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=713478","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2919","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:1299","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2919","tags":["report"]},{"url":"https://github.com/advisories/GHSA-7vjr-395v-c89g"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=672167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=681032","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=713477","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=730955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=731647","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1299.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-1594","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-1594","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1594","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2919","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2920","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2920","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2927","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-3344","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-3344","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3344","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-2919","description":"Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page.","status":"published","published":"2014-02-05T18:00:00Z","modified":"2024-08-06T23:15:31.782Z","updated_at":"2026-11-02T14:35:36.603688Z"}],"euvd":[{"id":"EUVD-2011-2892","description":"Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page.","status":"published","published":"2014-02-05T18:00:00Z","modified":"2024-08-06T23:15:31Z","updated_at":"2026-11-03T01:39:53.544801Z"}],"ghsa":[{"id":"GHSA-7vjr-395v-c89g","title":"Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN)...","description":"Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page.","status":"published","published":"2022-05-17T04:52:04Z","modified":"2023-02-02T15:30:35Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:52:46.933473Z"}],"nvd":[{"id":"CVE-2011-2919","description":"Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page.","status":"published","published":"2014-02-05T18:55:05.927Z","modified":"2026-06-16T23:32:15.247Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:12.639283Z"}],"osv":[{"id":"RHSA-2011:1299","title":"Red Hat Security Advisory: Red Hat Network Satellite server security and enhancement update","status":"published","published":"2024-09-15T19:23:24Z","modified":"2025-11-22T10:33:16Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}