CVE-2013-1869

Vulnerabilidad de inyección CRLF en spacewalk-java anterior a 2.1.148-1 y el satélite de Red Hat Network (RHN) 5.6 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias, y realizar ataques de división de respuestas HTTP y ataques de XSS, a través del parámetro return_url.

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. A cross-site scripting flaw was found in the way the Red Hat Satellite web interface performed sanitization of notes for registered systems. A remote authenticated Red Hat Satellite user could create a malicious note that, when viewed by a victim, could execute arbitrary web script with the privileges of the user viewing that note. Multiple cross-site scripting flaws were found in the Red Hat Satellite web interface. A remote attacker could provide a specially crafted link that, when visited by an authenticated Red Hat Satellite user, would lead to arbitrary web script execution in the context of the user's web interface session.