CVE-2016-3079: Red Hat Satellite

Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to systems/SystemEntitlements.do; (2) the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a (3) snapshot tag or (4) system group in System Set Manager (SSM).

Affected products

• Red Hat Satellite: version 5.7 only
• Red Hat Spacewalk-Java: affected versions not specified

Published 2016-04-14. Last modified 2026-06-17.