CVE-2013-6439
candlepin: insecure authentication enabled by default
Severity Score
9.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors.
Candlepin en Red Hat Subscription Asset Manager v1.0 hasta v1.3 utiliza un esquema de autenticación débil cuando el archivo de configuración no especifica un esquema, lo cual tiene un impacto no especificado y vectores de ataque.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2013-11-04 CVE Reserved
- 2013-12-22 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-287: Improper Authentication
- CWE-290: Authentication Bypass by Spoofing
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/90134 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2013-1863.html | 2023-02-13 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1042677 | 2013-12-19 | |
| https://access.redhat.com/security/cve/CVE-2013-6439 | 2013-12-19 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Subscription Asset Manager Search vendor "Redhat" for product "Subscription Asset Manager" | 1.0.0 Search vendor "Redhat" for product "Subscription Asset Manager" and version "1.0.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Subscription Asset Manager Search vendor "Redhat" for product "Subscription Asset Manager" | 1.1.0 Search vendor "Redhat" for product "Subscription Asset Manager" and version "1.1.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Subscription Asset Manager Search vendor "Redhat" for product "Subscription Asset Manager" | 1.2.0 Search vendor "Redhat" for product "Subscription Asset Manager" and version "1.2.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Subscription Asset Manager Search vendor "Redhat" for product "Subscription Asset Manager" | 1.2.1 Search vendor "Redhat" for product "Subscription Asset Manager" and version "1.2.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Subscription Asset Manager Search vendor "Redhat" for product "Subscription Asset Manager" | 1.3.0 Search vendor "Redhat" for product "Subscription Asset Manager" and version "1.3.0" | - |
Affected
| ||||||