CVE-2019-3845CWE-284

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2…

High · published April 11, 2019

CVSS v3.0
8.0
EPSS
1%
Percentile
51.8
In the wild
Unconfirmed
What it is

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

The record
Technical detail
CVSS v3.0
8.0 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00679 · 51.8th percentile
Weakness
CWE-284 · Improper Access Control
Published
2019-04-11T14:31Z
EPSS history
Timeline
  • 11 APR 14:31Z
    A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2…
    cvelistv5