CVE-2019-10137 HIGH

CVE-2019-10137

Vendor Spacewalkproject
Product spacewalk-proxy
Weakness CWE-22 · Path traversal
Published July 2, 2019
Last update August 4, 2024

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.

Key dates

02Disclosure timeline

July 2, 2019 CVE published
August 4, 2024 Record updated