What is CVE-2019-10137?

CVE-2019-10137 is a high-severity vulnerability in Spacewalkproject Spacewalk-Proxy, classified under Path Traversal. CVSS score: 8.1/10. Published 2019-07-02.

How severe is CVE-2019-10137?

High severity. CVSS v3 base score is 8.1 out of 10.

Path Traversal in Spacewalkproject Spacewalk-Proxy

CVE-2019-10137

A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.031 (87.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Spacewalkproject Spacewalk-proxy — versions spacewalk through 2.9
Redhat Satellite — versions 5.0
Redhat Spacewalk

Weakness classification (CWE)

CWE-22 — Path Traversal

References

secalert@redhat.com (x_refsource_CONFIRM, Mitigation, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2019-10137?: CVE-2019-10137 is a high-severity vulnerability in Spacewalkproject Spacewalk-Proxy, classified under Path Traversal. CVSS score: 8.1/10. Published 2019-07-02.
How severe is CVE-2019-10137?: High severity. CVSS v3 base score is 8.1 out of 10.