Satellite
Monthly
Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator accounts. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Authentication bypass in Red Hat Network Satellite 5.3, 5.4, and 5.5 lets remote unauthenticated attackers retrieve channel content through the Inter-Satellite Sync (ISS) operation by skipping the initial authentication call. The assessed impact is confidentiality-only (CVSS 7.5, C:H/I:N/A:N), and exploitation depends on ISS being in use and network-reachable. EPSS is 0.33% (56th percentile), and no public exploit was identified at time of analysis.
spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator accounts. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Authentication bypass in Red Hat Network Satellite 5.3, 5.4, and 5.5 lets remote unauthenticated attackers retrieve channel content through the Inter-Satellite Sync (ISS) operation by skipping the initial authentication call. The assessed impact is confidentiality-only (CVSS 7.5, C:H/I:N/A:N), and exploitation depends on ISS being in use and network-reachable. EPSS is 0.33% (56th percentile), and no public exploit was identified at time of analysis.
spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.