Unscored severity · published Apr 17, 2014
CVE-2013-2143
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to…
–
CVSS
48.2%
EPSS
No
On KEV
Description
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.
Exploitation
Is it being used?
Exploit prediction (EPSS)48.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KA
Katello · Theforeman
through 1.5.0-14 · source: NVD
NS
Network Satellite · Redhat
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2143
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2143
Exploit
http://packetstormsecurity.com/files/125866/Katello-Red-Hat-Satellite-users-update_roles-Missing-Authorization.html
Exploit
http://www.exploit-db.com/exploits/32515
www.osvdb.org
http://www.osvdb.org/104981
Exploit
http://www.securityfocus.com/bid/66434
More from Network Satellite
6.5
CVE-2011-1594
A flaw was found in Spacewalk, as used in Red Hat Network Satellite
5.5
CVE-2011-2920
A flaw was found in Spacewalk and Red Hat Network Satellite
5.4
CVE-2011-3344
A flaw was found in Spacewalk
5.4
CVE-2011-2927
A flaw was found in Spacewalk and Red Hat Network Satellite
–
CVE-2014-8162
XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have…