CVE-2014-3590

CWE-352 — Cross-Site Request Forgery (CSRF)5 documents5 sources
Severity
6.5MEDIUM
EPSS
0.2%
top 52.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
RED HAT Satellite 6 RED HAT Satellite 6Redhat Satellite
Timeline
PublishedJan 2
Latest updateMay 17

Description

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-246c-q58f-ccm9: Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action↗2022-05-17
▶
CVEList
CVE-2014-3590: Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action↗2020-01-02
▶

📋Vendor Advisories

1
Red Hat
rhn_satellite_6: cross-site request forgery (CSRF) can force logout↗2014-08-08
▶

💬Community

1
Bugzilla
CVE-2014-3590 rhn_satellite_6: cross-site request forgery (CSRF) can force logout↗2014-08-08
▶
CVE-2014-3590 (MEDIUM CVSS 6.5) | Versions of Foreman as shipped with | cvebase.io