Path Traversal in Spacewalkproject Spacewalk-Proxy
CVE-2019-10137
A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.031 (87.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 87.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.031 · newest: 0.031 · change: 0.000
Affected products
- Spacewalkproject Spacewalk-Proxy — versions spacewalk through 2.9
- Red Hat Satellite — versions 5.0
- Red Hat Spacewalk
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi (Mitigation, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-10137?
- CVE-2019-10137 is a high-severity vulnerability in Spacewalkproject Spacewalk-Proxy, classified under Path Traversal. CVSS score: 8.1/10. Published 2019-07-02.
- How severe is CVE-2019-10137?
- High severity. CVSS v3 base score is 8.1 out of 10.