PT-2013-5035 · Red Hat · Red Hat Satellite

Andrew Spurrier · CVE-2013-4480 · Published 2013-11-15 · Updated 2023-02-13

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Satellite versions 5.6 and earlier

Description The issue allows remote attackers to create administrator accounts due to the web interface not being disabled.

Recommendations For Red Hat Satellite versions 5.6 and earlier, disable the web interface used to create the first user for a satellite to prevent the creation of unauthorized administrator accounts.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2013-4480

RHSA-2013:1513

RHSA-2013:1514

Affected Products

Red Hat Satellite

References · 6

• http://rhn.redhat.com/errata/RHSA-2013-1514.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4480 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1513.html · Vendor Advisory
• https://access.redhat.com/site/articles/539283 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00009.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1024614 · Vendor Advisory