CVE-2009-4139

Red Hat Network Satellite Server v 5.4 · privilege escalation

CVSS 3.1 6.8 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2009-4139

Published

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2009-4139

Published

spacewalk-java

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Network Satellite Server v 5.4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "spacewalk-java",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:1.2.39-85.el5sat",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:network_satellite:5.4::el5"
                    ]
                }

rhnsd

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhnsd",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:6"
                    ]
                }

rhnsd

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhnsd",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:7"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON