Homepage

Cross-site Scripting (XSS) The advisory has been revoked - it doesn't affect any version of package satellite  (opens in a new tab)

Threat Intelligence

EPSS
0.21% (59th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Scripting (XSS) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL7-SATELLITE-5454059
  • published26 Mar 2023
  • disclosed9 Sept 2020
Report a new vulnerability Found a mistake?

Introduced: 9 Sep 2020

CVE-2020-15169  (opens in a new tab)
CWE-79  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:7.

NVD Description

Note: Versions mentioned in the description apply only to the upstream satellite package and not the satellite package as distributed by RHEL.

In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the t and translate helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.