CVE-2012-3503
The MITRE CVE dictionary describes this issue as:
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.
Find out more about CVE-2012-3503 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v2 metrics
| Base Score | 5 |
|---|---|
| Base Metrics | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| Access Vector | Network |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | Partial |
| Availability Impact | None |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Subscription Asset Manager 1.1 (katello) | RHSA-2012:1187 | 2012-08-21 |
| Red Hat CloudForms System Engine 1 (katello) | RHSA-2012:1186 | 2012-08-21 |
CVE description copyright © 2017, The MITRE Corporation