CVE-2014-8163: Path Traversal
Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5.
Other sources
Travis Emmert reports:
An XMLRPC interface is exposed that is intended for programmatic invocation from the client programs and related components. This interfaces exists on the satellite server at /XMLRPC. Note that this interface is different from the published interface exposed to endusers at /rpc/api. The application accepts data and a filename for writing the file too. The filename and resulting generated path is inspected, however the inspection does not consider all potential attacks. The verification on the path results in a situation where an attacker can write to an arbitrary file and directory under /var/satellite/
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8163?
CVE-2014-8163 has a severity rating of moderate, indicating a significant potential for exploitation.
How do I fix CVE-2014-8163?
To fix CVE-2014-8163, upgrade to a patched version of Red Hat Satellite that addresses the directory traversal vulnerability.
Which versions of Red Hat Satellite are affected by CVE-2014-8163?
CVE-2014-8163 affects Red Hat Satellite version 5.0.
What type of vulnerability is CVE-2014-8163?
CVE-2014-8163 is a directory traversal vulnerability specifically found in the XMLRPC interface of Red Hat Satellite.
Can CVE-2014-8163 lead to unauthorized access?
Yes, CVE-2014-8163 can potentially allow unauthorized access to files on the server due to the directory traversal flaw.