CVE-2018-1077: Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server

High severity · published Mar 14, 2018

CVE-2018-1077

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server

7.5

CVSS

EPSS

On KEV

Description

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 64% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Satellite · Redhat

5.0 · source: NVD

Spacewalk · Redhat

2.6 · source: NVD

Affected product

Satellite

Redhat

All Satellite CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-1077

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-1077

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=1555429