PT-2021-9722 · Red Hat · Red Hat Satellite

Published 2021-06-02 · Updated 2023-02-12 · CVE-2020-14380

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat Satellite versions 6.7.2 and later

Description A flaw was discovered that allows an account takeover. An attacker with proper authentication to an external authentication source, such as SSO or Open ID, can claim the privileges of existing local users.

Recommendations For Red Hat Satellite versions 6.7.2 and later, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-14380

RHSA-2020:4366

Affected Products

Red Hat Satellite

References · 4

• https://osv.dev/vulnerability/CVE-2020-14380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14380 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1873926 · Vendor Advisory
• https://t.me/cvenotify/15393 · Telegram Post