Suse Manager Server Module 4.3 vulnerabilities

7 CVEs affecting Suse Manager Server Module 4.3, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-46809, published 2025-07-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-46811, published 2025-07-30. Critical severity, CVSS 9.8. EPSS: 10.9% chance of exploitation in the next 30 days. A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects…
CVE-2025-23392, published 2025-05-26. Medium severity, CVSS 5.2. EPSS: 0.3% chance of exploitation in the next 30 days. A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code on target systems.This issue affects…
CVE-2025-23393, published 2025-05-27. Medium severity, CVSS 5.2. EPSS: 0.3% chance of exploitation in the next 30 days. A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects…
CVE-2024-49503, published 2024-11-28. Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days. A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascript code in the organization credentials…
CVE-2024-49502, published 2024-11-28. Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days. A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy credentials pane in spacewalk-web allows attackers to…
CVE-2025-46809, published 2025-07-31. Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days. A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ?…
CVE-2023-32189, published 2024-10-16. Medium severity, CVSS 5.9. EPSS: 0.1% chance of exploitation in the next 30 days. Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys