Critical severity · published Aug 25, 2012
CVE-2012-3503
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same…
9.8
CVSS
3%
EPSS
No
On KEV
Description
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux Server · Redhat
6.0 · source: NVD
KA
Katello · Theforeman
through 1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3503
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3503
Broken Link
http://rhn.redhat.com/errata/RHSA-2012-1186.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1187.html
Broken Link
http://secunia.com/advisories/50344
Broken Link
http://www.securityfocus.com/bid/55140
Patch
https://github.com/Katello/katello/commit/7c256fef9d75029d0ffff58ff1dcda915056d3a3
Issue Tracking
https://github.com/Katello/katello/pull/499
More from Enterprise Linux Server
9.8
CVE-2019-5544
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-4171
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2016-4117
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability