CVE-2011-4346

MediumCVSS 4.6/10Last modified Oct 30, 2026

Description

Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Network Satellite Server v 5.4	—
Red Hat	Red Hat Satellite 6	—
Red Hat	Red Hat Satellite 6	—

References

http://secunia.com/advisories/47162Broken Link
http://www.redhat.com/support/errata/RHSA-2011-1794.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/50963Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1026391Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2011:1794
https://access.redhat.com/security/cve/CVE-2011-4346
https://bugzilla.redhat.com/show_bug.cgi?id=742050Issue Tracking
http://secunia.com/advisories/47162Broken Link
http://www.redhat.com/support/errata/RHSA-2011-1794.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/50963Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1026391Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=742050Issue Tracking

Timeline

Published: Dec 10, 2011
Last modified: Oct 30, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-43474.0The kvm_vm_ioctl_assign_device function in virt/kvm/assigned-dev.c in the KVM subsystem in the Linux kernel before 3.1.10 does not verify pe CVE-2011-43487.1Race condition in the sctp_rcv function in net/sctp/input.c in the Linux kernel before 2.6.29 allows remote attackers to cause a denial of s CVE-2011-43494.6Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute ar CVE-2011-43506.5Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to CVE-2011-43517.5Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute ar CVE-2011-43526.8Integer overflow in the vp3_dequant function in the VP3 decoder (vp3.c) in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.CVE-2011-43534.3The (1) av_image_fill_pointers, (2) vp5_parse_coeff, and (3) vp6_parse_coeff functions in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7 CVE-2011-43545.8crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving CVE-2011-43556.9GNU Project Debugger (GDB) before 7.5, when .debug_gdb_scripts is defined, automatically loads certain files from the current working direct CVE-2011-43566.9Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of th CVE-2011-43577.5Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 an CVE-2011-43586.4Unspecified vulnerability in Oracle GlassFish Enterprise Server 3.0.1 and 3.1.1 allows remote attackers to affect confidentiality and integr