PT-2018-8388 · Red Hat+1 · Spacewalk-Channel+1

Published 2017-05-18 · Updated 2023-02-12 · CVE-2017-7470

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions spacewalk-channel (affected versions not specified)

Description An issue was found in spacewalk-channel where a non-admin user or disabled users can perform administrative tasks due to an incorrect authorization check in the backend/server/rhnChannel.py file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2017-7470

RHSA-2017:1259

SUSE-SU-2017:1346-1

SUSE-SU-2017:1347-1

SUSE-SU-2017:1349-1

SUSE-SU-2017:1352-1

SUSE-SU-2017_1347-1

Affected Products

Suse

Spacewalk-Channel

References · 69

• https://osv.dev/vulnerability/SUSE-SU-2017:1346-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1347-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7470 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:1349-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7470 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1352-1 · Vendor Advisory
• https://bugzilla.suse.com/1017422 · Note
• https://bugzilla.suse.com/1034465 · Note
• https://bugzilla.suse.com/1012784 · Note
• https://bugzilla.suse.com/1025275 · Note
• https://bugzilla.suse.com/1027873 · Note
• https://bugzilla.suse.com/1017772 · Note
• https://bugzilla.suse.com/1025758 · Note
• https://bugzilla.suse.com/1013606 · Note