CVE-2014-3590
published 2020-01-02CVE-2014-3590: Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user…
PriorityP429medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.52%
40.6th percentile
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| red_hat_satellite_6 | red_hat_satellite_6 | — | — |
| redhat | satellite | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rhn_satellite_6: cross-site request forgery (CSRF) can force logout
vendor_redhat·2014-08-08·CVSS 6.5
CVE-2014-3590 [MEDIUM] CWE-352 rhn_satellite_6: cross-site request forgery (CSRF) can force logout
rhn_satellite_6: cross-site request forgery (CSRF) can force logout
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content.
Statement: This issue affects the versions of foreman as shipped with Red Hat Satellite 6. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
GHSA
GHSA-246c-q58f-ccm9: Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action
ghsa_unreviewed·2022-05-17
CVE-2014-3590 [MEDIUM] GHSA-246c-q58f-ccm9: Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action
Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/security/cve/cve-2014-3590https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3590https://security-tracker.debian.org/tracker/CVE-2014-3590https://access.redhat.com/security/cve/cve-2014-3590https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3590https://security-tracker.debian.org/tracker/CVE-2014-3590
2020-01-02
Published