National Vulnerability Database

National Vulnerability Database

National Vulnerability

Search Results (Refine Search)

Search Parameters:
  • Contains Software Flaws (CVE)
  • CPE Product Version: cpe:/a:redhat:satellite:6.0
There are 11 matching records.
Vuln ID Summary CVSS Severity

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.

Published: August 01, 2019; 10:15:10 AM -04:00
V3.0: 7.4 HIGH
    V2: 6.5 MEDIUM

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

Published: April 11, 2019; 11:29:00 AM -04:00
V3.0: 8.0 HIGH
    V2: 5.2 MEDIUM

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.

Published: April 09, 2019; 12:29:02 PM -04:00
V3.0: 8.8 HIGH
    V2: 4.0 MEDIUM

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions.

Published: January 22, 2019; 10:29:00 AM -05:00
V3.0: 7.2 HIGH
    V2: 6.5 MEDIUM

A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.

Published: January 12, 2019; 09:29:00 PM -05:00
V3.0: 5.4 MEDIUM
    V2: 3.5 LOW

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.

Published: July 26, 2018; 01:29:00 PM -04:00
V3.0: 5.4 MEDIUM
    V2: 3.5 LOW

foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.

Published: April 16, 2018; 11:29:00 AM -04:00
V3.0: 8.8 HIGH
    V2: 4.0 MEDIUM

When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previously registered system the previously registered system will lose access to updates including security updates.

Published: February 27, 2018; 04:29:00 PM -05:00
V3.0: 2.7 LOW
    V2: 4.0 MEDIUM

Red Hat Satellite 6 allows local users to access mongod and delete pulp_database.

Published: August 28, 2017; 11:29:00 AM -04:00
V3.0: 6.1 MEDIUM
    V2: 4.6 MEDIUM

Red Hat Satellite 6 allows remote authenticated users with privileged access on a content host to authenticate to the capsule broker or server broker.

Published: June 07, 2017; 04:29:00 PM -04:00
V3.0: 8.8 HIGH
    V2: 6.5 MEDIUM

MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service.

Published: June 06, 2017; 02:29:00 PM -04:00
V3.0: 5.5 MEDIUM
    V2: 2.1 LOW