6.5Mittel

CVE-2011-1594Spacewalk: spacewalk: open redirect vulnerability enables phishing attacks via url parameter

Red Hat Red Hat Network Satellite Server v 5.4; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7 Veröffentlicht: 2014-02-05 20:00 (vor 12 Jahren)

Beschreibung

A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the url_bounce parameter. This can enable attackers to conduct phishing attacks, potentially leading to unauthorized information disclosure or credential theft.

Schwachstellentyp (CWE): CWE-601 CWE-20

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
network satellite	5.4	—
redhat	network satellite	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Network Satellite Server v 5.4	all versions
redhat	spacewalk	1.6

Referenzen und Patches

http://www.redhat.com/support/errata/RHSA-2011-1299.html PatchVendor Advisory
RHSA-2011:1299 vendor-advisory
https://access.redhat.com/security/cve/CVE-2011-1594 vdb-entry
https://bugzilla.redhat.com/show_bug.cgi?id=672167 Vendor Advisory
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html

CPE-Treffer (NVD) (2)

cpe:2.3:a:redhat:network_satellite:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:spacewalk:1.6:*:*:*:*:*:*:*

CVSS-Score

6.5Mittel

Quelle: redhat · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Erforderlich
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Keine
Verfügbarkeit: Keine

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Alle Scores (3)

cna	CVSS 3.1	6.5Mittel
secalert@redhat.com	CVSS 3.1	6.5Mittel
nvd	CVSS 2.0	5.8Mittel

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

1.46%

höher als 74 % aller CVEs

Zeitverlauf

ID reserviert2011-04-05
Veröffentlicht2014-02-05 20:00
Bei IP-DB eingegangen2026-10-24 23:53
Zuletzt aktualisiert2026-11-05 06:17

Vergeben von (CNA): redhat
NVD-Status: Modified

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Red Hat Enterprise Linux

6.2Mittel

CVE-2026-128886 gestern

Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because th…

5.5Mittel

CVE-2026-110330 gestern

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Hoch

CVE-2026-110331 gestern

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…

6.2Mittel

CVE-2026-128987 gestern

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…

5.5Mittel

CVE-2026-128885 gestern

Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize

Red Hat Red Hat Enterprise Linux 10

A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…

8.8Hoch

CVE-2026-18379 vor 3 Tagen

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…