CVE-2024-49503CWE-79

Reflected XSS in Setup Wizard, Organization Credentials in spacewalk-web

Medium · published November 28, 2024

CVSS v4.0
4.6
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascript code in the organization credentials sub page.

This issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.

The record
Technical detail
CVSS v4.0
4.6 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00279 · 19.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-11-28T09:20Z
EPSS history
Timeline
  • 28 NOV 09:20Z
    Reflected XSS in Setup Wizard, Organization Credentials in spacewalk-web
    cvelistv5