Redhat: >> Satellite >> 6.0 Security Vulnerabilities
An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions.
CVSS Score
6.8
EPSS Score
0.004
Published
2019-01-22
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
CVSS Score
5.4
EPSS Score
0.003
Published
2019-01-13
Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.
CVSS Score
3.5
EPSS Score
0.006
Published
2018-07-26
foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.
CVSS Score
4.7
EPSS Score
0.001
Published
2018-04-16
When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previously registered system the previously registered system will lose access to updates including security updates.
CVSS Score
2.7
EPSS Score
0.002
Published
2018-02-27
The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp.
CVSS Score
7.2
EPSS Score
0.017
Published
2017-10-18
Red Hat Satellite 6 allows local users to access mongod and delete pulp_database.
CVSS Score
6.1
EPSS Score
0.0
Published
2017-08-28
MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service.
CVSS Score
5.5
EPSS Score
0.0
Published
2017-06-06
Page 4