CVE-2009-4139
published 2011-07-27CVE-2009-4139: A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of…
PriorityP432medium6.8CVSS 3.1
AVNACHPRNUIRSUCHIHAN
EPSS
0.82%
53.1th percentile
A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | network_satellite_server | — | — |
| redhat | network_satellite_server | — | — |
| redhat | network_satellite_server | — | — |
| redhat | spacewalk-java | — | — |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
CVE-2009-4139: Cross-site request forgery (CSRF) vulnerability in the Spacewalk Java site packages (aka spacewalk-java) 1
vendor_redhat·2011-07-27·CVSS 6.8
CVE-2009-4139 [MEDIUM] CWE-346 CVE-2009-4139: Cross-site request forgery (CSRF) vulnerability in the Spacewalk Java site packages (aka spacewalk-java) 1
Cross-site request forgery (CSRF) vulnerability in the Spacewalk Java site packages (aka spacewalk-java) 1.2.39 in Spacewalk, as used in the server in Red Hat Network Satellite 5.3.0 through 5.4.1 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that (1) disable the current user account, (2) add user accounts, or (3) modify user accounts to have administrator privileges.
A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.
GHSA
GHSA-pvxx-xvvp-hc24: Cross-site request forgery (CSRF) vulnerability in the Spacewalk Java site packages (aka spacewalk-java) 1
ghsa_unreviewed·2022-05-02
CVE-2009-4139 [MEDIUM] CWE-352 GHSA-pvxx-xvvp-hc24: Cross-site request forgery (CSRF) vulnerability in the Spacewalk Java site packages (aka spacewalk-java) 1
Cross-site request forgery (CSRF) vulnerability in the Spacewalk Java site packages (aka spacewalk-java) 1.2.39 in Spacewalk, as used in the server in Red Hat Network Satellite 5.3.0 through 5.4.1 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that (1) disable the current user account, (2) add user accounts, or (3) modify user accounts to have administrator privileges.
No detection rules found.
No public exploits indexed.
http://securitytracker.com/id?1025674http://www.redhat.com/support/errata/RHSA-2011-0879.htmlhttps://access.redhat.com/security/cve/CVE-2009-4139https://bugzilla.redhat.com/show_bug.cgi?id=529483https://exchange.xforce.ibmcloud.com/vulnerabilities/68074http://securitytracker.com/id?1025674http://www.redhat.com/support/errata/RHSA-2011-0879.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=529483https://exchange.xforce.ibmcloud.com/vulnerabilities/68074
2011-07-27
Published