Login Request a demo
Critical severity · published Feb 17, 2020
CVE-2020-1693
A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint
9.8
CVSS
4.3%
EPSS
No
On KEV
Description
A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbitrary code on the Spacewalk server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spacewalk · Redhat
before 2.9 · source: NVD
Affected product
SP
Spacewalk
Redhat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1693
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1693
Patch
https://github.com/spacewalkproject/spacewalk/commit/74e28ec61d916c42061ef4347121650a1c962b0c
Exploit
https://zeroauth.ltd/blog/2020/02/18/proof-of-concept-exploit-for-cve-2020-1693-spacewalk/
More from Spacewalk
9.8
CVE-2019-10137
A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens
9.8
CVE-2017-7470
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in…
7.5
CVE-2018-1077
Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server
6.5
CVE-2011-1594
A flaw was found in Spacewalk, as used in Red Hat Network Satellite
5.5
CVE-2011-2920
A flaw was found in Spacewalk and Red Hat Network Satellite