Auth bypass in Red Hat Satellite

CVE-2013-2056

The Inter-Satellite Sync (ISS) operation in Red Hat Network (RHN) Satellite 5.3, 5.4, and 5.5 does not properly check client "authenticity," which allows remote attackers to obtain channel content by skipping the initial authentication call.

Vulnerability class: Broken Authentication

EPSS: 0.024 (82.1th percentile) — read the EPSS interpretation.

Affected products

Redhat Satellite — versions 5.3, 5.4, 5.5
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
secalert@redhat.com (x_refsource_OSVDB, vdb-entry)
secalert@redhat.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)