Rapid7 Vulnerability & Exploit Database

Red Hat: CVE-2022-23519: Important: Satellite 6.13 Release (RHSA-2023:2097)

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

Red Hat: CVE-2022-23519: Important: Satellite 6.13 Release (RHSA-2023:2097)

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
12/14/2022
Created
05/05/2023
Added
05/04/2023
Modified
09/18/2023

Description

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.

Solution(s)

  • redhat-upgrade-foreman-cli
  • redhat-upgrade-python39-pulp_manifest
  • redhat-upgrade-rubygem-amazing_print
  • redhat-upgrade-rubygem-apipie-bindings
  • redhat-upgrade-rubygem-clamp
  • redhat-upgrade-rubygem-domain_name
  • redhat-upgrade-rubygem-fast_gettext
  • redhat-upgrade-rubygem-ffi
  • redhat-upgrade-rubygem-ffi-debuginfo
  • redhat-upgrade-rubygem-ffi-debugsource
  • redhat-upgrade-rubygem-foreman_maintain
  • redhat-upgrade-rubygem-gssapi
  • redhat-upgrade-rubygem-hammer_cli
  • redhat-upgrade-rubygem-hammer_cli_foreman
  • redhat-upgrade-rubygem-hammer_cli_foreman_admin
  • redhat-upgrade-rubygem-hammer_cli_foreman_ansible
  • redhat-upgrade-rubygem-hammer_cli_foreman_azure_rm
  • redhat-upgrade-rubygem-hammer_cli_foreman_bootdisk
  • redhat-upgrade-rubygem-hammer_cli_foreman_discovery
  • redhat-upgrade-rubygem-hammer_cli_foreman_google
  • redhat-upgrade-rubygem-hammer_cli_foreman_openscap
  • redhat-upgrade-rubygem-hammer_cli_foreman_remote_execution
  • redhat-upgrade-rubygem-hammer_cli_foreman_tasks
  • redhat-upgrade-rubygem-hammer_cli_foreman_templates
  • redhat-upgrade-rubygem-hammer_cli_foreman_virt_who_configure
  • redhat-upgrade-rubygem-hammer_cli_foreman_webhooks
  • redhat-upgrade-rubygem-hammer_cli_katello
  • redhat-upgrade-rubygem-hashie
  • redhat-upgrade-rubygem-highline
  • redhat-upgrade-rubygem-http-accept
  • redhat-upgrade-rubygem-http-cookie
  • redhat-upgrade-rubygem-jwt
  • redhat-upgrade-rubygem-little-plugger
  • redhat-upgrade-rubygem-locale
  • redhat-upgrade-rubygem-logging
  • redhat-upgrade-rubygem-mime-types
  • redhat-upgrade-rubygem-mime-types-data
  • redhat-upgrade-rubygem-multi_json
  • redhat-upgrade-rubygem-netrc
  • redhat-upgrade-rubygem-oauth
  • redhat-upgrade-rubygem-oauth-tty
  • redhat-upgrade-rubygem-powerbar
  • redhat-upgrade-rubygem-rest-client
  • redhat-upgrade-rubygem-snaky_hash
  • redhat-upgrade-rubygem-unf
  • redhat-upgrade-rubygem-unf_ext
  • redhat-upgrade-rubygem-unf_ext-debuginfo
  • redhat-upgrade-rubygem-unf_ext-debugsource
  • redhat-upgrade-rubygem-unicode
  • redhat-upgrade-rubygem-unicode-debuginfo
  • redhat-upgrade-rubygem-unicode-debugsource
  • redhat-upgrade-rubygem-unicode-display_width
  • redhat-upgrade-rubygem-version_gem
  • redhat-upgrade-satellite-cli
  • redhat-upgrade-satellite-clone
  • redhat-upgrade-satellite-maintain

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;