CVE-2011-2919

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.redhat.com/support/errata/RHSA-2011-1299.htmlPatch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=713478Vendor Advisory
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.htmlVendor Advisory
http://www.redhat.com/support/errata/RHSA-2011-1299.htmlPatch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=713478Vendor Advisory
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.htmlVendor Advisory

Timeline

Published: Feb 5, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-29205.5A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remote attacker to injec CVE-2011-29219.8ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can res CVE-2011-29227.8ktsuss versions 1.4 and prior spawns the GTK interface to run as root. This can allow a local attacker to escalate privileges to root and us CVE-2011-29235.5foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the deb CVE-2011-29245.5foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the CVE-2011-29254.6Cumin in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0 records broker authentication credentials in a log file, which allows lo CVE-2011-29275.4A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), allows remote attacker CVE-2011-29284.9The befs_follow_link function in fs/befs/linuxvfs.c in the Linux kernel before 3.1-rc3 does not validate the length attribute of long symlin CVE-2011-29295.0The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x befor CVE-2011-29307.5Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connect CVE-2011-29314.3Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ru CVE-2011-29324.3Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.