Vulnerability record · CVE-2013-1823 · published 2 April 2013

CVE-2013-1823: Redhat subscription asset manager cross-site scripting vulnerability

Redhat · Subscription Asset Manager

Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.

4.3 CVSS 2.0 Medium EPSS 1.9% · top 20.9% CWE-79 · Cross-site scripting

4.3CVSS 2.0 base score

1.9%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 2 tagged exploit

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Subscription Asset Manager Redhat

References

Link	Tags
http://rhn.redhat.com/errata/RHSA-2013-0686.html	Vendor Advisory
http://secunia.com/advisories/52774	Vendor Advisory
http://www.osvdb.org/91718
https://bugzilla.redhat.com/show_bug.cgi?id=918784	Exploit
http://rhn.redhat.com/errata/RHSA-2013-0686.html	Vendor Advisory
http://secunia.com/advisories/52774	Vendor Advisory
http://www.osvdb.org/91718
https://bugzilla.redhat.com/show_bug.cgi?id=918784	Exploit

Track CVE-2013-1823 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2014-0130Ruby on Rails implicit-render directory traversal allows arbitrary file readRuby on Rails versions before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1 contain a directory traversal flaw in the implicit-render implementa…KEVEPSS 54%analysed7 May 2014 9.8CVE-2015-7501Red Hat JBoss Java deserialization allows remote command executionMultiple Red Hat JBoss products deserialize untrusted Java objects and, through the Apache Commons Collections library, allow remote attackers to exe…EPSS 86%analysed9 Nov 2017 9.3CVE-2013-6439Redhat subscription asset manager improper authentication vulnerabilityCandlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a sche…EPSS 1.6%23 Dec 2013 7.5CVE-2012-6685Nokogiri vulnerabilityNokogiri before 1.5.4 is vulnerable to XXE attacksEPSS 2.2%19 Feb 2020 6.5CVE-2014-0026Redhat subscription asset manager cross-site request forgery vulnerabilitykatello-headpin is vulnerable to CSRF in REST APIEPSS 0.43%11 Dec 2019 6.5CVE-2013-6461Nokogiri vulnerabilityNokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limitsEPSS 2.2%5 Nov 2019 6.5CVE-2013-6460Nokogiri vulnerabilityNokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documentsEPSS 2.1%5 Nov 2019 6.1CVE-2014-0183Redhat subscription asset manager cross-site scripting vulnerabilityVersions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.EPSS 0.66%2 Jan 2020

Source: NIST National Vulnerability Database (record CVE-2013-1823), CISA KEV, FIRST EPSS (scores of 2026-10-07). This page is refreshed as NVD updates the record.