Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-10137

A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.

Published

2019-07-02T20:15:11.450

Last Modified

2024-11-21T04:18:29.667

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-22
  • Type: Secondary
    CWE-22
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application redhat satellite 5.0 Yes
Application redhat spacewalk ≤ 2.9 Yes
References