Vulnerability record · CVE-2011-2920 · published 5 February 2014

CVE-2011-2920: Redhat network satellite cross-site scripting vulnerability

Redhat · Network Satellite

A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remote attacker to inject arbitrary web script or HTML into web pages through various input fields, such as the "Filter by Synopsis" field. This could lead to the execution of malicious code in a user's web browser, potentially compromising user sessions or disclosing sensitive information.

5.5 CVSS 3.1 Medium EPSS 2.0% · top 19.6% CWE-79 · Cross-site scripting

5.5CVSS 3.1 base score, v2 4.3

2.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

7References

16 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Network Satellite Redhat

Spacewalk Redhat

References

Link	Tags
http://www.redhat.com/support/errata/RHSA-2011-1299.html	PatchVendor Advisory
https://access.redhat.com/security/cve/CVE-2011-2920
https://bugzilla.redhat.com/show_bug.cgi?id=681032	Vendor Advisory
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2011-1299.html	PatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=681032	Vendor Advisory
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html	Vendor Advisory

Track CVE-2011-2920 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-1693Redhat spacewalk xml external entity (xxe) vulnerabilityA flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated …EPSS 4.3%17 Feb 2020 9.8CVE-2019-10137Redhat satellite path traversal vulnerabilityA path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthen…EPSS 3.1%2 Jul 2019 9.8CVE-2017-7470Redhat spacewalk incorrect authorization vulnerabilityIt was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorizati…EPSS 2.1%27 Jul 2018 7.5CVE-2018-1077Redhat spacewalk xml external entity (xxe) vulnerabilitySpacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.EPSS 1.0%14 Mar 2018 7.5CVE-2014-8162Redhat network satellite vulnerabilityXML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbit…EPSS 2.7%14 May 2015 7.5CVE-2013-4480Redhat network satellite exposure of resource to wrong sphere vulnerabilityRed Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attac…EPSS 2.1%18 Nov 2013 6.5CVE-2013-2143Katello and Red Hat Satellite missing authorization in update_rolesThe users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action. A remote authe…EPSS 48%analysed17 Apr 2014 6.5CVE-2011-1594Redhat network satellite open redirect vulnerabilityA flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to ar…EPSS 1.5%5 Feb 2014

Source: NIST National Vulnerability Database (record CVE-2011-2920), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.