{"id":"CVE-2022-43754","aliases":["EUVD-2022-46731","GHSA-vjvm-4cfh-7m4p","SUSE-SU-2022:3878-1","SUSE-SU-2022:3879-1","SUSE-SU-2022:3880-1"],"status":"published","title":"SUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.do","description":"An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.","severity":{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00468,"percentile":0.40823,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-11-04T14:24:46Z","modified":"2026-06-17T05:07:15Z","affected":[{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"hub-xmlrpc-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-150300.3.9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4-150300.8.25.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"locale-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3-150300.3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-150300.7.7.26.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"python-urlgrabber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.2.1py2_3-150300.3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.20-150300.4.30.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.25-150300.4.32.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.21-150300.4.27.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.43-150300.3.48.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.18-150300.3.21.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-150300.3.30.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.38-150300.3.44.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.36.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.25-150300.3.30.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.28-150300.3.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.10-150300.3.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.10-150300.3.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.10-150300.3.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.39-150400.3.11.1"}]}],"bundled":3}],"products":[{"vendor":"suse","product":"manager_server"},{"vendor":"suse","product":"suse linux enterprise module for suse manager server 4.2"},{"vendor":"suse","product":"suse linux enterprise module for suse manager server 4.3"},{"vendor":"suse","product":"suse manager server 4.2"},{"vendor":"uyuni-project","product":"uyuni"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1204741","tags":["x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43754"},{"url":"https://github.com/advisories/GHSA-vjvm-4cfh-7m4p"},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223878-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195624","tags":["report"]},{"url":"https://bugzilla.suse.com/1197724","tags":["report"]},{"url":"https://bugzilla.suse.com/1199726","tags":["report"]},{"url":"https://bugzilla.suse.com/1200596","tags":["report"]},{"url":"https://bugzilla.suse.com/1201059","tags":["report"]},{"url":"https://bugzilla.suse.com/1201788","tags":["report"]},{"url":"https://bugzilla.suse.com/1202167","tags":["report"]},{"url":"https://bugzilla.suse.com/1202729","tags":["report"]},{"url":"https://bugzilla.suse.com/1202785","tags":["report"]},{"url":"https://bugzilla.suse.com/1203283","tags":["report"]},{"url":"https://bugzilla.suse.com/1203406","tags":["report"]},{"url":"https://bugzilla.suse.com/1203422","tags":["report"]},{"url":"https://bugzilla.suse.com/1203564","tags":["report"]},{"url":"https://bugzilla.suse.com/1203599","tags":["report"]},{"url":"https://bugzilla.suse.com/1203611","tags":["report"]},{"url":"https://bugzilla.suse.com/1203898","tags":["report"]},{"url":"https://bugzilla.suse.com/1204146","tags":["report"]},{"url":"https://bugzilla.suse.com/1204203","tags":["report"]},{"url":"https://bugzilla.suse.com/1204543","tags":["report"]},{"url":"https://bugzilla.suse.com/1204716","tags":["report"]},{"url":"https://bugzilla.suse.com/1204741","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43754","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223879-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223880-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-43754","title":"SUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.do","description":"An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.","status":"published","published":"2022-11-10T07:30:18.906Z","modified":"2025-04-30T19:54:37.083Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-46731","description":"An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.","status":"published","published":"2022-11-10T07:30:18Z","modified":"2025-04-30T19:54:37Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:51:58.556756Z"}],"ghsa":[{"id":"GHSA-vjvm-4cfh-7m4p","title":"An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...","description":"An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.","status":"published","published":"2022-11-10T19:01:09Z","modified":"2023-01-28T05:03:16Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:56.576463Z"}],"nvd":[{"id":"CVE-2022-43754","description":"An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.","status":"published","published":"2022-11-10T15:15:19.747Z","modified":"2026-06-17T05:07:15.137Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:31.914793Z"}],"osv":[{"id":"SUSE-SU-2022:3878-1","title":"Security update for SUSE Manager Server 4.2","description":"\nThis update fixes the following issues:\n\nhub-xmlrpc-api:\n\n- Use golang(API) = 1.18 for building on SUSE (bsc#1203599)\n  This source fails to build with the current go1.19 on SUSE and we \n  need to use go1.18 instead.\n\ninter-server-sync:\n\n- Version 0.2.4 \n  * Improve memory usage and log information #17193\n  * Conditional insert check for FK reference exists (bsc#1202785)\n  * Correct navigation path for table rhnerratafilechannel (bsc#1202785)\n\nlocale-formula:\n\n- Update to version 0.3\n  * Remove .map.gz from kb_map dictionary (bsc#1203406)\n\npy27-compat-salt:\n\n- Fix state.apply in test mode with file state module\n  on user/group checking (bsc#1202167)\n- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)\n\npython-urlgrabber:\n\n- Fix wrong logic on find_proxy method causing proxy not being used\n  (bsc#1201788)\n\nspacecmd:\n\n- Version 4.2.20-1\n  * Remove 'Undefined return code' from debug messages (bsc#1203283)\n\nspacewalk-backend:\n\n- Version 4.2.25-1\n  * Enhance passwords cleanup and add extra files in spacewalk-debug (bsc#1201059)\n  * Prevent mixing credentials for proxy and repository server\n    while using basic authentication and avoid hiding errors\n    i.e. timeouts while having proxy settings issues\n    with extra logging in verbose mode (bsc#1201788)\n\nspacewalk-client-tools:\n\n- Version 4.2.21-1\n  * Update translation strings\n\nspacewalk-java:\n\n- Version 4.2.43-1\n  * CVE-2022-31255: Fix directory path traversal vulnerability (bsc#1204543)\n  * CVE-2022-43754: Fix reflected cross site scripting vulnerability (bsc#1204741)\n  * CVE-2022-43753: Fix arbitrary file disclosure vulnerability (bsc#1204716)\n- Version 4.2.42-1\n  * Properly pass allow vendor change to salt state (bsc#1204203)\n  * add ongres requirements to spec file (bsc#1203898)\n  * Refresh pillar data (bsc#1197724)\n  * Fix hardware update where there is no DNS FQDN changes (bsc#1203611)\n  * Use mgrnet.dns_fqdns module to improve FQDN detection (bsc#1199726)\n  * Support Pay-as-you-go new CA location for SLES15SP4\n    and higher (bsc#1202729)\n  * Detect the clients running on Amazon EC2 (bsc#1195624)\n\nspacewalk-utils:\n\n- Version 4.2.18-1\n  * Make spacewalk-hostname-rename working with settings.yaml\n    cobbler config file (bsc#1203564)\n\nspacewalk-web:\n\n- Version 4.2.30-1\n  * Upgrade moment-timezone\n\nsusemanager:\n\n- Version 4.2.38-1\n  * add venv-salt-minion to bootstrap repo (bsc#1204146)\n\nsusemanager-doc-indexes:\n\n- Documented that only SUSE clients are supported as monitoring servers\n  in the Administration Guide\n- Fixed description of default notification settings (bsc#1203422)\n- Added missing Debian 11 references\n- Removed references to Debian 9, as it is EoL, and therefore \n  unsupported by SUSE Manager\n- Document Helm deployment of the proxy on k3s and MetalLB in Installation\n  and Upgrade Guide\n- Added secure mail communication settings in Administration Guide\n- Fixed the incorrect path to state and pillar files in Salt Guide\n- Documented how pxeboot works with Secure Boot enabled in Client\n  Configuration Guide\n- Added SLE Micro 5.2 and 5.3 as available as a technology preview in\n  the Client Configuration Guide, and the IBM Z architecture for 5.1,\n  5.2, and 5.3\n\nsusemanager-docs_en:\n\n- Documented that only SUSE clients are supported as monitoring servers\n  in the Administration Guide\n- Fixed description of default notification settings (bsc#1203422)\n- Added missing Debian 11 references\n- Removed references to Debian 9, as it is EoL, and therefore \n  unsupported by SUSE Manager\n- Document Helm deployment of the proxy on k3s and MetalLB in Installation\n  and Upgrade Guide\n- Added secure mail communication settings in Administration Guide\n- Fixed the incorrect path to state and pillar files in Salt Guide\n- Documented how pxeboot works with Secure Boot enabled in Client\n  Configuration Guide\n- Added SLE Micro 5.2 and 5.3 as available as a technology preview in \n  the Client Configuration Guide, and the IBM Z architecture for 5.1, \n  5.2, and 5.3\n\nsusemanager-schema:\n\n- Version 4.2.25-1\n  * Add subtypes for Amazon EC2 virtual instances (bsc#1195624)\n\nsusemanager-sls:\n\n- Version 4.2.28-1\n  * Fix mgrnet availability check\n  * Remove dependence on Kiwi libraries\n  * Use mgrnet.dns_fqdns module to improve FQDN detection (bsc#1199726)\n  * Add mgrnet salt module with mgrnet.dns_fqnd function implementation\n    allowing to get all possible FQDNs from DNS (bsc#1199726)\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2022-11-04T14:24:46Z","modified":"2026-02-04T02:37:58.884364Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3879-1","title":"Security update for release-notes-susemanager, release-notes-susemanager-proxy","description":"This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:\n\nRelease notes for SUSE Manager:\n\n- Update to SUSE Manager 4.2.10\n  * Apache exporter has been upgraded to version 0.11.0\n  * CVEs fixed: \n    CVE-2022-43753, CVE-2022-43754, CVE-2022-31255\n  * Bugs mentioned:\n    bsc#1195624, bsc#1197724, bsc#1199726, bsc#1200596, bsc#1201059\n    bsc#1201788, bsc#1202167, bsc#1202729, bsc#1202785, bsc#1203283\n    bsc#1203406, bsc#1203422, bsc#1203564, bsc#1203599, bsc#1203611\n    bsc#1203898, bsc#1204146, bsc#1204203, bsc#1195624, bsc#1197724\n    bsc#1199726, bsc#1200596, bsc#1201059, bsc#1201788, bsc#1202167\n    bsc#1202729, bsc#1202785, bsc#1203283, bsc#1203406, bsc#1203422\n    bsc#1203564, bsc#1203599, bsc#1203611, bsc#1203898, bsc#1204146\n    bsc#1204716, bsc#1204741, bsc#1204543\n\nRelease notes for SUSE Manager Proxy:\n\n- Update to SUSE Manager 4.2.10\n  * Bugs mentioned: \n    bsc#1201059, bsc#1201788, bsc#1203283\n","status":"published","published":"2022-11-04T14:25:43Z","modified":"2026-02-04T03:46:25.027355Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3880-1","title":"Security update for spacewalk-java","description":"This update for spacewalk-java fixes the following issues:\n\n- CVE-2022-31255: Fix directory path traversal vulnerability (bsc#1204543)\n- CVE-2022-43754: Fix reflected cross site scripting vulnerability (bsc#1204741)\n- CVE-2022-43753: Fix arbitrary file disclosure vulnerability (bsc#1204716)\n","status":"published","published":"2022-11-04T14:27:00Z","modified":"2026-02-04T02:57:25.652095Z","updated_at":"2026-11-02T15:53:51.440565Z"}]}}