CSRF in Red Hat Enterprise Linux 6
CVE-2009-4139
A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.
EPSS: 0.008 (54.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
Affected products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Redhat Network_satellite_server — versions 5.3.0, 5.4.0, 5.4.1
- Redhat Spacewalk-java — versions 1.2.39
Weakness classification (CWE)
References
- secalert@redhat.com
- secalert@redhat.com (Patch, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com
- secalert@redhat.com
Frequently asked questions
- What is CVE-2009-4139?
- CVE-2009-4139 is a medium-severity vulnerability in Red Hat Enterprise Linux 6, classified under Origin Validation Error. CVSS score: 6.8/10. Published 2011-07-27.
- How severe is CVE-2009-4139?
- Medium severity. CVSS v3 base score is 6.8 out of 10.