CVE-2022-4130: Medium severity redhat Satellite vulnerability
A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external interaction to an attacker's server by modifying the Referer header in an HTTP request of specific resources in the server.
Other sources
Satellite is executing external requests via the Referer header under the /location/clear path. It is possible to trigger an external interaction to an attacker's server, by executing a GET request to /locations/clear and modifying the Referer header to an attacker-controlled server.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this blind site-to-site request forgery vulnerability in Satellite server?
The vulnerability ID is CVE-2022-4130.
What is the severity level of CVE-2022-4130?
The severity level of CVE-2022-4130 is medium with a severity value of 4.5.
Which versions of Redhat Satellite are affected by CVE-2022-4130?
Redhat Satellite versions 6.9, 6.10, and 6.11 are affected by CVE-2022-4130.
How does this vulnerability in Satellite server work?
This vulnerability allows an attacker to trigger an external interaction to their server by modifying the Referer header in an HTTP request of specific resources in the server.
Is there a reference link regarding CVE-2022-4130?
Yes, you can find more information about CVE-2022-4130 at this link: [https://bugzilla.redhat.com/show_bug.cgi?id=2145254](https://bugzilla.redhat.com/show_bug.cgi?id=2145254)