CVE-2019-10137

A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.

CVSS v3 8.1 HIGH
CVSS v2.0 7.5 HIGH

8.1^/10

CVSS v3 : HIGH

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137	Issue Tracking Mitigation Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137	Issue Tracking Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:satellite:5.0:::::::*
	cpe:2.3:a:redhat:spacewalk::::::::

History

21 Nov 2024, 04:18

Type	Values Removed	Values Added
CVSS	v2 : ~~7.5~~ v3 : ~~9.8~~	v2 : 7.5 v3 : 8.1
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137 - Issue Tracking, Mitigation, Vendor Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137 - Issue Tracking, Mitigation, Vendor Advisory

Information

Published : 2019-07-02 20:15

Updated : 2024-11-21 04:18

NVD link : CVE-2019-10137

Mitre link : CVE-2019-10137

CVE.ORG link : CVE-2019-10137

JSON object : View

Products Affected

redhat

spacewalk
satellite

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2019-10137", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-07-02T20:15:11.450", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137", "tags": ["Issue Tracking", "Mitigation", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137", "tags": ["Issue Tracking", "Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo de salto de ruta (path) en el proxy de spacewalk, en todas las versiones hasta la 2.8, en la manera en que el proxy procesa los tokens del cliente en la cach\u00e9. Un atacante remoto no autenticado podr\u00eda utilizar este fallo para probar la existencia de archivos arbitrarios, si tienen acceso al sistema de archivos del proxy, o si pueden ejecutar c\u00f3digo arbitrario en el contexto del proceso httpd."}], "lastModified": "2024-11-21T04:18:29.667", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE6BFE59-8452-45DF-A6DD-75EACE54E180"}, {"criteria": "cpe:2.3:a:redhat:spacewalk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F4D92AC-1EBC-4E45-A682-6D77E361F353", "versionEndIncluding": "2.9"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}