CVE-2025-23392 | THREATINT

Description

A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code on target systems.This issue affects Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3.

Reserved 2025-01-15 | Published 2025-05-26 | Updated 2025-05-27 | Assigner suse

MEDIUM: 5.2CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

MEDIUM: 5.6CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Product status

Default status

unaffected

? before 5.0.24-150600.3.25.1

affected

Default status

unaffected

? before 5.0.24-150600.3.25.1

affected

Default status

unaffected

? before 5.0.24-150600.3.25.1

affected

Default status

unaffected

? before 5.0.24-150600.3.25.1

affected

Default status

unaffected

? before 4.3.85-150400.3.105.3

affected

Default status

unaffected

? before 4.3.85-150400.3.105.3

affected

Default status

unaffected

? before 4.3.85-150400.3.105.3

affected

Default status

unaffected

? before 4.3.85-150400.3.105.3

affected

Credits

https://github.com/unix-geek finder

References

bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23392

cve.org (CVE-2025-23392)

nvd.nist.gov (CVE-2025-23392)

Download JSON