Information disclosure in Red Hat Satellite 6.13 For Rhel 8
CVE-2024-8553
A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view and create templates to read any field from Foreman's database. By using specific strings in the loader macros, users can bypass permissions and access sensitive information.
Vulnerability class: Information Disclosure
EPSS: 0.004 (35.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Red Hat Satellite 6.13 For Rhel 8 — versions 0:3.5.1.25-1.el8sat
- Red Hat Satellite 6.14 For Rhel 8 — versions 0:3.7.0.14-1.el8sat
- Red Hat Satellite 6.15 For Rhel 8 — versions 0:3.9.1.11-1.el8sat
- Red Hat Satellite 6.16 For Rhel 8 — versions 0:3.12.0.1-1.el8sat
- Red Hat Satellite 6.16 For Rhel 9 — versions 0:3.12.0.1-1.el9sat
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
Frequently asked questions
- What is CVE-2024-8553?
- CVE-2024-8553 is a medium-severity vulnerability in Red Hat Satellite 6.13 For Rhel 8, classified under Information Disclosure. CVSS score: 6.3/10. Published 2024-10-31.
- How severe is CVE-2024-8553?
- Medium severity. CVSS v3 base score is 6.3 out of 10.
- Is CVE-2024-8553 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.