CVE-2019-10137
spacewalk-proxy: Path traversal in proxy authentication cache
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.
Se encontró un fallo de salto de ruta (path) en el proxy de spacewalk, en todas las versiones hasta la 2.8, en la manera en que el proxy procesa los tokens del cliente en la caché. Un atacante remoto no autenticado podría utilizar este fallo para probar la existencia de archivos arbitrarios, si tienen acceso al sistema de archivos del proxy, o si pueden ejecutar código arbitrario en el contexto del proceso httpd.
A path traversal flaw was found in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-03-27 CVE Reserved
- 2019-07-02 CVE Published
- 2023-08-11 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137 | 2023-02-12 | |
| https://access.redhat.com/security/cve/CVE-2019-10137 | 2019-07-02 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1702604 | 2019-07-02 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Satellite Search vendor "Redhat" for product "Satellite" | 5.0 Search vendor "Redhat" for product "Satellite" and version "5.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Spacewalk Search vendor "Redhat" for product "Spacewalk" | <= 2.9 Search vendor "Redhat" for product "Spacewalk" and version " <= 2.9" | - |
Affected
| ||||||