5.5
CVE-2021-4142
- EPSS 0.1%
- Published 24.08.2022 16:15:09
- Last modified 21.11.2024 06:36:59
- Source secalert@redhat.com
- Teams watchlist Login
- Open Login
The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.
Data is provided by the National Vulnerability Database (NVD)
Candlepinproject ≫ Candlepin Version >= 3.1.0 <= 3.1.28-2
Candlepinproject ≫ Candlepin Version >= 3.2.0 <= 3.2.21-1
Candlepinproject ≫ Candlepin Version >= 4.1.0 <= 4.1.8-1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.1% | 0.29 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-639 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.