CVE-2019-3845 — Improper Access Control in Redhat Satellite

CWE-284 — Improper Access Control5 documents5 sources
Severity
8.0HIGHNVD
EPSS
0.2%
top 61.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat SatelliteRED HAT Qpid-dispatch-router
Timeline
PublishedApr 11
Latest updateMay 13

Description

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages2 packages

▶NVDredhat/satellite< 6.2
▶CVEListV5red_hat/qpid-dispatch-routerfixed in Satellite 6.1 - Optional, fixed in Satellite >= 6.2, fixed in Satellite Capsule 6.1+2

🔴Vulnerability Details

2
GHSA
GHSA-rcf7-8mg9-v2ww: A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite↗2022-05-13
▶
CVEList
CVE-2019-3845: A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite↗2019-04-11
▶

📋Vendor Advisories

1
Red Hat
katello-installer-base: QMF methods exposed to goferd via qdrouterd↗2019-04-09
▶

💬Community

1
Bugzilla
CVE-2019-3845 katello-installer-base: QMF methods exposed to goferd via qdrouterd↗2019-02-28
▶
CVE-2019-3845 — Improper Access Control in Redhat | cvebase