Attackers can attack users by providing specially crafted URLs to click
CVE-2024-49502

3.5LOW

Key Information:

Vendor
Suse
Status
Container Suse/manager/5.0/x86 64/server:5.0.2.7.8.1
Suse Manager Server Module 4.3
Vendor
CVE Published:
28 November 2024

Summary

A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy credentials pane in spacewalk-web allows attackers to attack users by providing specially crafted URLs to click. This issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1.

Affected Version(s)

Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1 0 < 5.0.15-150600.3.10.2

SUSE Manager Server Module 4.3 0 < 4.3.42-150400.3.52.1

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49502

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Paolo Perego of SUSE
.