CVE:CVE-2013-4415
CNNVD:CNNVD-201402-195
Red Hat Satellite（RHN Satellite，红帽网络卫星）是美国红帽（Red Hat）公司的一套系统管理平台。Spacewalk是基于红帽网络卫星而开发的一套开源Linux系统管理解决方案。
Spacewalk和RHN Satellite 5.6版本中存在跨站脚本漏洞，该漏洞源于当执行搜索操作时，程序没有充分过滤多个参数（包括：'end_minute', 'end_month', 'end_year', 'errata_type_bug', 'errata_type_enhancement', 'errata_type_security', 'fineGrained', 'list_1892635924_sortdir', 'optionIssueDateSearch', 'start_am_pm', 'start_day', 'start_hour', 'start_minute', 'start_month', 'start_year'和'view_mode'）。远程攻击者可利用该漏洞注入任意Web脚本或HTML。
solution:Upgrade redhat satellite to a higher version than 5.6,and avoid the version 5.6; Upgrade redhat satellite_5_managed_db to a higher version than 5.6,and avoid the version 5.6; Upgrade redhat spacewalk-java to a higher version than 2.0.2,and avoid the version (,2.0.2); Upgrade redhat spacewalk-web to a higher version than 2.0.3,and avoid the version (,2.0.3); Upgrade suse manager to a higher version than 1.7,and avoid the version 1.7