CVE-2016-3080 Cross-site scripting in n/a
Remote attackers can inject arbitrary web script or HTML via monitoring probe parameters in Red Hat Satellite, potentially leading to session hijacking or malicious actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-3080?
CVE-2016-3080 is a medium-severity cross-site scripting vulnerability in Redhat Satellite, published on 5 Aug 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script or HTML via the (1) RHNMD User or (2) Filesystem parameters, related to display of monitoring probes.
Weakness: CWE-79
Which versions are affected by CVE-2016-3080?
It affects 1 product.
Products include Redhat Satellite.
How do I fix CVE-2016-3080?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2016-3080 being exploited?
There is no known exploitation of CVE-2016-3080 in the wild and no public exploit code.
Other vulnerabilities in Redhat Satellite
- CVE-2024-7012 Puppet-foreman: an authentication bypass vulnerability exists in foreman
- CVE-2024-7923 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
- CVE-2026-96659 Foreman: excessive permissions for viewer role on preview
- CVE-2023-0118 Foreman: arbitrary code execution through templates
- CVE-2008-2369 Hardcoded credentials in n/a
Sources
Also known as GHSA-fqjj-c6x2-9xww.