REDHAT-BUG-529483: CSRF
First published: Sat Oct 17 2009(Updated: )
It was found that Red Hat Network (RHN) Satellite and Spacewalk services did not protect against Cross-Site Request Forgery (CSRF) attacks. If an authenticated RHN Satellite or Spacewalk service user visited a specially- crafted web page, it could lead to unauthorized command execution with the privileges of that user, for example, creating a new user account, granting administrator privileges to user accounts, disabling the account of the current user, and so on. Acknowledgements: Red Hat would like to thank Christian Johansson of Bitsec AB and Thomas Biege of the SUSE Security Team for independently reporting this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Network Satellite | ||
| Spacewalk |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-529483?
The severity of REDHAT-BUG-529483 is typically classified as high due to the potential for unauthorized command execution via CSRF attacks.
How do I fix REDHAT-BUG-529483?
To fix REDHAT-BUG-529483, update to the latest version of Red Hat Network Satellite or Spacewalk that includes the security patches addressing CSRF vulnerabilities.
What vulnerabilities are associated with REDHAT-BUG-529483?
REDHAT-BUG-529483 is associated with vulnerabilities related to Cross-Site Request Forgery (CSRF) that can lead to unauthorized actions by authenticated users.
Who is affected by REDHAT-BUG-529483?
Users of Red Hat Network Satellite and Spacewalk are affected by REDHAT-BUG-529483 if they do not implement the recommended security updates.
What kind of attack does REDHAT-BUG-529483 exploit?
REDHAT-BUG-529483 exploits Cross-Site Request Forgery (CSRF), allowing attackers to execute unauthorized commands on behalf of authenticated users.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-4139
- agent/references
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat network satellite
- canonical/spacewalk