{"id":"CVE-2017-7538","aliases":["EUVD-2017-16551","GHSA-5v3c-p3h6-5654","RHSA-2017:2645","SUSE-SU-2017:2257-1","SUSE-SU-2017:2453-1"],"status":"published","title":"A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite...","description":"A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.","severity":{"version":"3.0","score":3.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00746,"percentile":0.55084,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2017-08-25T11:42:16Z","modified":"2026-07-28T10:45:04Z","fixes":[{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"satellite-schema","fixed_in":["0:5.8.0.33-1.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-app","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-applet","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-cdn","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-config-files","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-config-files-common","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-config-files-tool","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-iss","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-iss-export","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-libs","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-package-push-server","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-server","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-sql","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-sql-oracle","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-sql-postgresql","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-tools","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-xml-export-libs","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-xmlrpc","fixed_in":["0:2.5.3-151.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-java","fixed_in":["0:2.5.14-95.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-java-config","fixed_in":["0:2.5.14-95.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-java-lib","fixed_in":["0:2.5.14-95.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-java-oracle","fixed_in":["0:2.5.14-95.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-java-postgresql","fixed_in":["0:2.5.14-95.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-schema","fixed_in":["0:2.5.1-50.el6sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-taskomatic","fixed_in":["0:2.5.14-95.el6sat"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"salt-netapi-client","fixed_in":["0.12.0-16.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"smdba","fixed_in":["1.6.0-0.7.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-backend","fixed_in":["2.5.24.13-26.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-branding","fixed_in":["2.5.2.14-16.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-config","fixed_in":["2.5.2.8-13.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-java","fixed_in":["2.5.59.17-27.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-search","fixed_in":["2.5.2.3-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-setup-jabberd","fixed_in":["2.5.0.3-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-web","fixed_in":["2.5.7.18-25.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"susemanager","fixed_in":["3.0.23-25.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"susemanager-docs_en","fixed_in":["3-25.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"susemanager-schema","fixed_in":["3.0.21-25.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"susemanager-sync-data","fixed_in":["3.0.18-28.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"virtual-host-gatherer","fixed_in":["1.0.14-7.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"satellite-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.0.33-1.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-applet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-cdn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-config-files","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-config-files-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-config-files-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-iss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-iss-export","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-package-push-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-sql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-sql-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-sql-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-xml-export-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-backend-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-151.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.14-95.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-java-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.14-95.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-java-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.14-95.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-java-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.14-95.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-java-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.14-95.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-50.el6sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"spacewalk-taskomatic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.14-95.el6sat"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"jabberd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.80.3-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"rhnpush","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.104.3-2.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-0.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.8.6-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.73.7-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2.7-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0.7-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.46.5-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.3.2-2.3.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.10.5-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1.10-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.8-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3-10.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.9-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-16.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-0.7.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.24.13-26.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2.14-16.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2.8-13.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.59.17-27.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2.3-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-setup-jabberd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0.3-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7.18-25.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.23-25.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3-25.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-25.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-28.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"virtual-host-gatherer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-7.3.1"}]}]}],"products":[{"vendor":"[unknown]","product":"satellite"},{"vendor":"red hat","product":"satellite"},{"vendor":"redhat","product":"satellite"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7538","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1039267","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2645","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7538","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5v3c-p3h6-5654"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/site/articles/273633","tags":["article"]},{"url":"https://access.redhat.com/site/articles/11258","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458765","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1467632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475067","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477667","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2645.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7538","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7538","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172257-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1009118","tags":["report"]},{"url":"https://bugzilla.suse.com/1017513","tags":["report"]},{"url":"https://bugzilla.suse.com/1019759","tags":["report"]},{"url":"https://bugzilla.suse.com/1028098","tags":["report"]},{"url":"https://bugzilla.suse.com/1030898","tags":["report"]},{"url":"https://bugzilla.suse.com/1031143","tags":["report"]},{"url":"https://bugzilla.suse.com/1031602","tags":["report"]},{"url":"https://bugzilla.suse.com/1032324","tags":["report"]},{"url":"https://bugzilla.suse.com/1032350","tags":["report"]},{"url":"https://bugzilla.suse.com/1033999","tags":["report"]},{"url":"https://bugzilla.suse.com/1035728","tags":["report"]},{"url":"https://bugzilla.suse.com/1037609","tags":["report"]},{"url":"https://bugzilla.suse.com/1038321","tags":["report"]},{"url":"https://bugzilla.suse.com/1039458","tags":["report"]},{"url":"https://bugzilla.suse.com/1039579","tags":["report"]},{"url":"https://bugzilla.suse.com/1039913","tags":["report"]},{"url":"https://bugzilla.suse.com/1042199","tags":["report"]},{"url":"https://bugzilla.suse.com/1042552","tags":["report"]},{"url":"https://bugzilla.suse.com/1042846","tags":["report"]},{"url":"https://bugzilla.suse.com/1042975","tags":["report"]},{"url":"https://bugzilla.suse.com/1043143","tags":["report"]},{"url":"https://bugzilla.suse.com/1043430","tags":["report"]},{"url":"https://bugzilla.suse.com/1043795","tags":["report"]},{"url":"https://bugzilla.suse.com/1043831","tags":["report"]},{"url":"https://bugzilla.suse.com/1044719","tags":["report"]},{"url":"https://bugzilla.suse.com/1045152","tags":["report"]},{"url":"https://bugzilla.suse.com/1045266","tags":["report"]},{"url":"https://bugzilla.suse.com/1045981","tags":["report"]},{"url":"https://bugzilla.suse.com/1046176","tags":["report"]},{"url":"https://bugzilla.suse.com/1046218","tags":["report"]},{"url":"https://bugzilla.suse.com/1046314","tags":["report"]},{"url":"https://bugzilla.suse.com/1046865","tags":["report"]},{"url":"https://bugzilla.suse.com/1047282","tags":["report"]},{"url":"https://bugzilla.suse.com/1047352","tags":["report"]},{"url":"https://bugzilla.suse.com/1047513","tags":["report"]},{"url":"https://bugzilla.suse.com/1047641","tags":["report"]},{"url":"https://bugzilla.suse.com/1047656","tags":["report"]},{"url":"https://bugzilla.suse.com/1047680","tags":["report"]},{"url":"https://bugzilla.suse.com/1047707","tags":["report"]},{"url":"https://bugzilla.suse.com/1048183","tags":["report"]},{"url":"https://bugzilla.suse.com/1048968","tags":["report"]},{"url":"https://bugzilla.suse.com/1049162","tags":["report"]},{"url":"https://bugzilla.suse.com/1049425","tags":["report"]},{"url":"https://bugzilla.suse.com/1049471","tags":["report"]},{"url":"https://bugzilla.suse.com/1049575","tags":["report"]},{"url":"https://bugzilla.suse.com/1049664","tags":["report"]},{"url":"https://bugzilla.suse.com/1049665","tags":["report"]},{"url":"https://bugzilla.suse.com/1050385","tags":["report"]},{"url":"https://bugzilla.suse.com/1051518","tags":["report"]},{"url":"https://bugzilla.suse.com/1051719","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7538","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172453-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1022286","tags":["report"]},{"url":"https://bugzilla.suse.com/1024058","tags":["report"]},{"url":"https://bugzilla.suse.com/1026930","tags":["report"]},{"url":"https://bugzilla.suse.com/1045575","tags":["report"]},{"url":"https://bugzilla.suse.com/1047155","tags":["report"]},{"url":"https://bugzilla.suse.com/1048528","tags":["report"]},{"url":"https://bugzilla.suse.com/1048762","tags":["report"]},{"url":"https://bugzilla.suse.com/1049170","tags":["report"]},{"url":"https://bugzilla.suse.com/1053850","tags":["report"]},{"url":"https://bugzilla.suse.com/1054225","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7538","description":"A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.","status":"published","published":"2018-07-26T15:00:00Z","modified":"2024-08-05T16:04:11.974Z","cvss":[{"version":"3.0","score":3.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16551","description":"A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.","status":"published","published":"2018-07-26T15:00:00Z","modified":"2024-08-05T16:04:11Z","cvss":[{"version":"3.0","score":3.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T02:39:08.024596Z"}],"ghsa":[{"id":"GHSA-5v3c-p3h6-5654","title":"A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite...","description":"A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.","status":"published","published":"2022-05-13T01:36:17Z","modified":"2023-02-01T05:08:35Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:50:48.372333Z"}],"nvd":[{"id":"CVE-2017-7538","description":"A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users.","status":"published","published":"2018-07-26T15:29:00.26Z","modified":"2026-06-17T01:24:33.787Z","cvss":[{"version":"3.0","score":3.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"RHSA-2017:2645","title":"Red Hat Security Advisory: satellite and spacewalk security and bug fix update","status":"published","published":"2024-09-16T00:30:15Z","modified":"2026-07-28T10:45:04.690546381Z","cvss":[{"version":"3.0","score":3.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"SUSE-SU-2017:2257-1","title":"Security update for SUSE Manager Server 3.1","description":"This update for the SUSE Manager Server 3.1 provides several fixes and improvements.\n\nThe following security issues have been fixed:\n\njabberd:\n\n- Fix offered SASL mechanism check. (bsc#1047282, CVE-2017-10807)\n\nspacewalk-java:\n\n- Do not allow XSS as Organization name. (bsc#1048968, CVE-2017-7538)\n\nAdditionally, the following non-security issues have been fixed:\n\ncobbler:\n\n- Fix missing arguments and location for Xen. (bsc#1048183)\n\njabberd:\n\n- Fix memory leak in pgsql storage driver.\n- Fix two double-frees caused by dangling pointers.\n- wss:// (WebSocket over SSL) support in c2s.\n- Allow BareJID S10N packets.\n- SQLite postconnect SQL support.\n- Support WebSocket fragmented packets.\n- Module to verify users using e-mail.\n- Use OpenSSL functions for base64 en/decoding when available.\n- Option to dump packet-filter matched packets to file.\n- bcrypt support for PostgreSQL and MySQL storage.\n- Option to set authreg module per realm.\n- WebSocket C2S SX plugin.\n- Support for RSA/DH/ECDH key agreement.\n- For a detailed description of all fixes, please refer to the changelog.\n\nosad:\n\n- Reduce maximal size of osad log before rotating.\n- Perform osad restart in posttrans. (bsc#1039913)\n\nsalt-netapi-client:\n\n- Fix date format for Schedule.\n- Fix sending kwarg in payload in RunnerCall.\n- Better error handling in Runner and Wheel calls.\n- Increase the default SOCKET_TIMEOUT to 20 seconds.\n\nsmdba:\n\n- Add support for postgresql96. (bsc#1045152)\n\nspacecmd:\n\n- Configchannel export binary flag to json. (bsc#1044719)\n\nspacewalk-backend:\n\n- Make master_label static to keep its value when retrying. (bsc#1038321)\n- Adapt for the new gpgcheck flag for the channels.\n\nspacewalk-branding:\n\n- Fix overlapping of elements. (bsc#1031143)\n- Fix overlapping text narrow window. (bsc#1009118) \n- Fix formulas action buttons position. (bsc#1047513)\n- Fix broken link. (bsc#1033999)\n- Alphabar: Change title to 'Select first character'. (bsc#1042199)\n\nspacewalk-certs-tools:\n\n- Improve text for bootstrap. (bsc#1032324)\n\nspacewalk-java:\n\n- Don't add default channel if AK is not valid. (bsc#1047656)\n- Add 'Enable GPG check' function for channels.\n- No legend icon for Activity Ocurring. (bsc#1051719)\n- Implement API call for bootstrapping systems.\n- Fix product ids reported for SUSE Manager Server to the subscription matcher.\n- Fix adding products when assigning channels. (bsc#1049664)\n- Set default memory size for SLES 12 installations to 1024MB. (bsc#1047707)\n- Enable remote-command for Salt clients in SSM. (bsc#1050385)\n- Add missing help icons/links. (bsc#1049425)\n- Fix invalid help links. (bsc#1049425) \n- Fix wrong openscap xid. (bsc#1030898)\n- Fix overlapping text narrow window. (bsc#1009118) \n- Fixes alignment on the orgdetails. (bsc#1017513)\n- Fix text for activation key buttons. (bsc#1042975) \n- Correctly set, check and cut textarea maxlength. (bsc#1043430)\n- MinionActionExecutor: Raise skip timeout. (bsc#1046865)\n- Update channels.xml with OpenStack Cloud Continuous Delivery 6. (bsc#1039458)\n- Do not create VirtualInstance duplicates for the same 'uuid'.\n- Add taskomatic task to cleanup duplicated uuids for same system id.\n- Handle possible wrong UUIDs on SLE11 minions. (bsc#1046218)\n- Removed duplicate overview menu item. (bsc#1045981) \n- Enable act-key name empty on creation. (bsc#1032350)\n- Fix NPE when there's not udev results. (bsc#1042552)\n- Alphabar: Change title to 'Select first character'. (bsc#1042199)\n- Duplicate Systems: Correct language not to mention 'profiles'. (bsc#1035728)\n- Fix list filters to work with URL special characters. (bsc#1042846)\n- Use getActive() instead of isActive() for JavaBeans compliance. (bsc#1043143)\n- Fix hide non-org event details. (bsc#1039579)\n\nspacewalk-search:\n\n- Remove executable bit from service files. (bsc#1051518)\n\nspacewalk-utils:\n\n- Don't show password on input in spacewalk-manage-channel-lifecycle. (bsc#1043795)\n\nspacewalk-web:\n\n- Fix overlapping of elements. (bsc#1031143)\n- Fix formulas action buttons position. (bsc#1047513)\n- Do not show old messages. (bsc#1043831)\n- Add a dynamic counter of the remaining textarea length.\n- Confirm if navigating away while bootstrapping.\n\nsusemanager:\n\n- Assert correct java version. (bsc#1049575)\n- Create bootstrap repository for SLES for SAP 11 SP1. (bsc#1049471)\n- Adjust the bootstrap repository with SLE 12 SP3 repositories.\n\nsusemanager-docs_en:\n\n- Improve Icinga services example. (bsc#1019759)\n- Make Section reference Configuration Management more clear. (bsc#1047352)\n- Add missing 'host_name' in service definition example for Icinga. (bsc#1049162)\n- Fix documentation on moving database. (bsc#1031602)\n- Add missing Autoinstallation page in Advanced Topics guide. (bsc#1047680)\n- Make API documentation available online. (bsc#1047641)\n- Fix Reference Guide Documentation issues. (bsc#1045266)\n- Update online documentation components. (bsc#1046314)\n- Update online documentation. (bsc#1046176)\n\nsusemanager-schema:\n\n- Adapt for the new gpgcheck flag for the channels.\n\nsusemanager-sync-data:\n\n- Add support for SLE 12 SP3 product family, SUSE Enterprise Storage 5, OpenStack Cloud 6 Continuous Delivery\n  and Public Cloud for ppc64le. (bsc#1028098, bsc#1039458, bsc#1037609, bsc#1049665)\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\nspacewalk-service stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\nspacewalk-schema-upgrade\n5. Start the Spacewalk service:\nspacewalk-service start\n","status":"published","published":"2017-08-25T11:42:16Z","modified":"2026-02-04T03:19:23.211028Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2453-1","title":"Security update for SUSE Manager Server 3.0","description":"This update for the SUSE Manager Server 3.0 provides several fixes and improvements.\n\nThe following security issue has been fixed:\n\nspacewalk-java:\n\n- CVE-2017-7538: Do not allow HTML code injection via Cross Site Scripting (XSS) in the Organization Name. (bsc#1048968)\n\nAdditionally, the following non-security issues have been fixed:\n\nsalt-netapi-client:\n\n- Fix date format for Schedule.\n- Fix sending kwarg in payload in RunnerCall.\n- Better error handling in Runner and Wheel calls.\n- Increase the default SOCKET_TIMEOUT to 20 seconds\n\nsmdba:\n\n- Do not set default_statistics_target. (bsc#1022286)\n- Support postgresql96. (bsc#1045152)\n- Prevent use of /var/lib/pgsql/data. (bsc#1024058)\n- Remove copyright message every time shown.\n- On systemd-enabled systems use it for start/stop PostgreSQL. (bsc#1024058)\n\nspacewalk-backend:\n\n- Increase rpclib timeout to 10 minutes. (bsc#1026930)\n- Adapt for the new gpgcheck flag for the channels.\n\nspacewalk-branding:\n\n- Fix overlapping text narrow window. (bsc#1009118)\n\nspacewalk-config:\n\n- Resolve comps.xml file for repositories. (bsc#1048528)\n\nspacewalk-java:\n\n- Delete and create new ServerNetAddress if it already exists on Hardware refresh. (bsc#1054225)\n- Fix enter key submit on ListTag filter input. (bsc#1048762)\n- Create VirtpollerData object with JSON content instead null. (bsc#1049170)\n- Prevent malformed XML if 'arch' is set to NULL. (bsc#1045575)\n- Resolve comps.xml file for repositories. (bsc#1048528)\n- Don't add default channel if AK is not valid. (bsc#1047656)\n- Add 'Enable GPG check' function for channels.\n- Regenerate pillar for the minions using the channel being modified.\n- Remove executable bit from service files. (bsc#1051518)\n- Fix wrong openscap xid. (bsc#1030898)\n- Fix overlapping text narrow window. (bsc#1009118)\n- Fix broken link. (bsc#1033999)\n- Fix alignment on the org details. (bsc#1017513)\n- Update channels.xml with OpenStack Cloud Continuous Delivery 6. (bsc#1039458)\n- Handle possible wrong UUIDs on SLE 11 minions. (bsc#1046218)\n- Allow blank key generation. (bsc#1032350)\n\nspacewalk-search:\n\n- Remove executable bit from service files. (bsc#1051518)\n\nspacewalk-setup-jabberd:\n\n- Change default backend for jabberd to sqlite. (bsc#1047155)\n\nspacewalk-web:\n\n- Fix enter key submit on ListTag filter input. (bsc#1048762)\n\nsusemanager:\n\n- Do not use checkpoint_segments parameter during migrations.\n- Enable migration from postgresql94 to postgresql96.\n- Create bootstrap repository for SUSE Linux Enterprise Server for SAP 11 SP1. (bsc#1049471)\n- Adjust the bootstrap repository with SUSE Linux Enterprise 12 SP3 repositories.\n\nsusemanager-docs_en:\n\n- Update text and image files.\n\nsusemanager-schema:\n\n- Adapt for the new gpgcheck flag for the channels.\n\nsusemanager-sync-data:\n\n- Add SUSE Manager Proxy 3.0 channels for SUSE Linux Enterprise Server 12 SP3. (bsc#1053850)\n- Support SUSE Enterprise Storage 5 and SUSE Linux Enterprise Server 12 SP3 for SAP Applications\n  on ppc64le. (bsc#1028098)\n- Update channels.xml with OpenStack Cloud Continuous Delivery 6. (bsc#1039458)\n- Add SUSE Linux Enterprise 12 SP3 related products. (bsc#1037609)\n\nvirtual-host-gatherer:\n\n- Implement kubernetes gatherer module.\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\nspacewalk-service stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\nspacewalk-schema-upgrade\n5. Start the Spacewalk service:\nspacewalk-service start\n","status":"published","published":"2017-09-13T13:50:30Z","modified":"2026-02-04T02:29:17.973163Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}