CVE Feed

    Dashboard / CVE / CVE-2019-10137

    CVE-2019-10137

    A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.

    Published:Jul 1, 2019
    Last Modified:Nov 21, 2024
    EPS:Jul 2, 2019
    EPSS Score:0.08937
    CVSS Score:8.1

    Affected Products

    Vendor
    Redhat
    Product
    Network Proxy
    Vendor
    Redhat
    Product
    Satellite
    Vendor
    Redhat
    Product
    Spacewalk

    Exploits

    No exploit reference

    Related CVEs

    CVE-2010-2236 (CVSS 6) — The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 thro…
    CVE-2012-5562 (CVSS 8.6) — A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clea…
    CVE-2012-3525 (CVSS 5.8) — s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback r…
    CVE-2012-2673 (CVSS 5) — Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_g…
    CVE-2012-0059 (CVSS 4.9) — A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registra…
    CVE-2011-1755 (CVSS 7.5) — jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attacke…
    CVE-2007-6388 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 t…
    CVE-2007-5000 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.…
    CVE-2007-4465 (CVSS 6.1) — Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the c…
    CVE-2006-5752 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High