{"id":"CVE-2025-53883","aliases":["EUVD-2025-36996","GHSA-h2fm-479p-v37r","SUSE-SU-2025:3826-1","SUSE-SU-2025:3827-1"],"status":"published","title":"spacewalk-java has various XSS issues on search page","description":"A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00293,"percentile":0.22139,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-80"],"published":"2025-10-28T07:26:47Z","modified":"2026-10-18T00:10:00Z","fixes":[{"ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"rhnlib","fixed_in":["4.3.7-150400.3.9.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"spacewalk-backend","fixed_in":["4.3.34-150400.3.58.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"spacewalk-web","fixed_in":["4.3.46-150400.3.63.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"susemanager-build-keys","fixed_in":["15.4.11-150400.3.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"susemanager-tftpsync-recv","fixed_in":["4.3.11-150400.3.15.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server LTS 4.3","package":"rhnlib","fixed_in":["4.3.7-150400.3.9.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server LTS 4.3","package":"spacewalk-backend","fixed_in":["4.3.34-150400.3.58.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server LTS 4.3","package":"spacewalk-java","fixed_in":["4.3.88-150400.3.113.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server LTS 4.3","package":"spacewalk-web","fixed_in":["4.3.46-150400.3.63.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server LTS 4.3","package":"susemanager-build-keys","fixed_in":["15.4.11-150400.3.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server LTS 4.3","package":"susemanager-sls","fixed_in":["4.3.50-150400.3.68.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.7-150400.3.9.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.34-150400.3.58.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.46-150400.3.63.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.11-150400.3.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"susemanager-tftpsync-recv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150400.3.15.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.7-150400.3.9.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.34-150400.3.58.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.88-150400.3.113.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.46-150400.3.63.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.11-150400.3.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.50-150400.3.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16.1-150400.3.101.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16.1-150400.3.143.2"}]}],"bundled":3}],"products":[{"vendor":"suse","product":"container suse manager 5.0"},{"vendor":"suse","product":"suse manager server lts 4.3"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53883"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53883"},{"url":"https://github.com/advisories/GHSA-h2fm-479p-v37r"},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253826-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227577","tags":["report"]},{"url":"https://bugzilla.suse.com/1246439","tags":["report"]},{"url":"https://bugzilla.suse.com/1250911","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53883","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253827-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246277","tags":["report"]},{"url":"https://bugzilla.suse.com/1248252","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53880","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-53883","title":"spacewalk-java has various XSS issues on search page","description":"A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.","status":"published","published":"2025-10-30T10:50:07.58Z","modified":"2026-02-26T16:56:50.56Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:32:48.853452Z"}],"euvd":[{"id":"EUVD-2025-36996","description":"A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.","status":"published","published":"2025-10-30T10:50:07Z","modified":"2026-02-26T16:56:50Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T19:48:25.612568Z"}],"ghsa":[{"id":"GHSA-h2fm-479p-v37r","title":"A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability...","description":"A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.","status":"published","published":"2025-10-30T12:31:11Z","modified":"2025-10-30T12:31:17Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T15:04:15.305123Z"}],"nvd":[{"id":"CVE-2025-53883","description":"A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.","status":"published","published":"2025-10-30T11:15:33.28Z","modified":"2026-10-18T00:10:00.123Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:11:41.607433Z"}],"osv":[{"id":"SUSE-SU-2025:3826-1","title":"Security update 4.3.16.1 for SUSE Manager Server 4.3 LTS","description":"This update fixes the following issues:\n\nsusemanager-build-keys:\n    \n- Update SUSE GPG key and make it available for Salt (bsc#1250911)\n\nsusemanager-sls:\n\n- Version 4.3.50-0\n  * Fix OS Family grain name (bsc#1250911)\n- Version 4.3.49-0\n  * Fixed syntax error in Salt state\n- Version 4.3.48-0\n  * Automatically deploy the SUSE GPG key (bsc#1250911)\n    \nspacewalk-java:\n\n- Version 4.3.88-0 with security fix:\n  * CVE-2025-53883: Escape input strings in system search form (bsc#1246439)\n\nrhnlib:\n\n- Version 4.3.7-0:\n  * Use more secure defusedxml parser (bsc#1227577)\n    \nspacewalk-backend:\n\n- Version 4.3.34-0:\n  * Use more secure defusedxml parser (bsc#1227577)\n\nspacewalk-web:\n\n- Version 4.3.46-0:\n  * Bumped the WebUI version to 4.3.16.1\n    \nHow to apply this update:\n\n1. Log in as root user to the Multi-Linux Manager Server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2025-10-28T07:26:47Z","modified":"2025-10-28T20:32:36.700628Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3827-1","title":"Security update 4.3.16.1 for SUSE Manager Server Release Notes","description":"This update fixes the following issues:\n    \nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.16.1\n  * CVEs Fixed:\n    CVE-2025-53883, CVE-2025-53880, CVE-2025-53192\n  * Bugs mentioned:\n    bsc#1246439, bsc#1246277, bsc#1248252\n","status":"published","published":"2025-10-28T07:26:58Z","modified":"2026-02-04T04:20:42.019378Z","updated_at":"2026-11-02T15:54:00.344164Z"}]}}