Medium 6.8

Cross-site request forgery (CSRF) vulnerability in the Spacewalk Java site packages (aka...

CVE-2009-4139 First seen on SecPulse Jul 27, 2011

Original description The description as published by the source.

Cross-site request forgery (CSRF) vulnerability in the Spacewalk Java site packages (aka spacewalk-java) 1.2.39 in Spacewalk, as used in the server in Red Hat Network Satellite 5.3.0 through 5.4.1 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that (1) disable the current user account, (2) add user accounts, or (3) modify user accounts to have administrator privileges.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.8; CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Published: Jul 27, 2011
First seen on SecPulse: Jul 27, 2011
GHSA: GHSA-pvxx-xvvp-hc24
CWE: CWE-346 CWE-352

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

Java

Attack Types

Cross-Site Request Forgery Privilege Escalation

All

CWE-346 Red Hat Network Satellite Server V 54 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Redhat Network Satellite Server Spacewalk Java

Vendors

Red Hat

CWE

CWE-352

Detection sources

NIST National Vulnerability DatabaseNov 5, 13:17
GitHub Security Advisories (Global)Oct 31, 06:31
CVE.org (CVE Program・cvelistV5)Nov 5, 12:10