Log in Start free

Vulnerability · Published May 27, 2025 · Assigned by suse

CVE-2025-23393Reflected XSS in spacewalk-java

Medium 5.2

In plain English

A medium-severity security flaw in Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1 from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)5.2Medium
Exploit odds (30 days)0.4%top 69.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in  spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3.

Affected products (as reported)

VendorProductVersions
SUSE Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1 ? – before 5.0.24-150600.3.25.1
SUSE SUSE Manager Server Module 4.3 ? – before 4.3.85-150400.3.105.3

Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

References