CVE-2024-7012

Katalog CVE

CVSS 9.8 · Critical EPSS 0,77%

Kerentanan Improper Authentication pada redhat satellite. Skor CVSS 3.1 9.8 (Critical) menurut redhat.com.

Deskripsi (NVD)

An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.

Rincian

Terbit di NVD

4 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2024:6335 advisory vendor
• https://access.redhat.com/errata/RHSA-2024:6336 advisory vendor
• https://access.redhat.com/errata/RHSA-2024:6337 advisory vendor
• https://access.redhat.com/security/cve/CVE-2024-7012 mitigasi · advisory vendor
• https://access.redhat.com/errata/RHSA-2024:8906
• https://bugzilla.redhat.com/show_bug.cgi?id=2299429 issue tracking