6.8

CVE-2009-4139

Spacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Network Satellite Server Version5.3.0
Redhat ≫ Network Satellite Server Version5.4.0
Redhat ≫ Network Satellite Server Version5.4.1
Redhat ≫ Spacewalk-java Version1.2.39
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.82% 0.524
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
secalert@redhat.com 6.8 1.6 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://securitytracker.com/id?1025674
http://www.redhat.com/support/errata/RHSA-2011-0879.html
Patch
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=529483
https://exchange.xforce.ibmcloud.com/vulnerabilities/68074
https://access.redhat.com/security/cve/CVE-2009-4139