Katello
CVE-2012-3503
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS score of 9.8 (CRITICAL). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. EPSS exploitation probability: 1.30%. |
| Exploit ScenarioDerived | A remote attacker could gain access using credentials embedded in source code by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in rubygems
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token. Affected products include: Theforeman Katello, Redhat Enterprise Linux Server.
Know when Katello gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update
Katello allows remote attackers to cause a denial of service (memory consumption) via the (1) mode parameter in the setu
Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb
Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying
An authorization flaw in Katello's Flatpak Remote Repositories API allows an authenticated user who is permitted to view
A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Desc
Cross-organization repository metadata disclosure in the Katello (Red Hat Satellite 6) Docker Tags repositories API allo
A SQL injection flaw was found in katello's errata-related API. Rated medium severity (CVSS 4.3), this vulnerability is
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Rated low severi
script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, wh
modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for th
Exploit-DB