A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external interaction to an attacker's server by modifying the Referer header in an HTTP request of specific resources in the server.
CVSS Details
- CVSS 3.1 Base Score: 4.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-unf_extUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-domain_nameUpgrade rubygem-version_gemUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade satelliteUpgrade rubygem-clampUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffi-debuginfoUpgrade satellite-cliUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade rubygem-localeUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-amazing_printUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade rubygem-highlineUpgrade rubygem-powerbarUpgrade rubygem-fast_gettextUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicode-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-apipie-bindingsUpgrade rubygem-rest-clientUpgrade rubygem-unicodeUpgrade rubygem-oauthUpgrade satellite-cloneUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-little-pluggerUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-brandingUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foremanUpgrade satellite-maintainUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-unicode-debugsourceUpgrade rubygem-oauth-ttyUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-display_width | Nov 13, 2023 | Dec 16, 2022 |
| Redhat_linux | — | Upgrade rubygem-netrcUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffiUpgrade rubygem-unicode-display_widthUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-loggingUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-version_gemUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-brandingUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffi-debugsourceUpgrade rubygem-clampUpgrade rubygem-unicode-debugsourceUpgrade satellite-cliUpgrade rubygem-http-acceptUpgrade satellite-maintainUpgrade rubygem-unicode-debuginfoUpgrade satelliteUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-oauth-ttyUpgrade rubygem-oauthUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-highlineUpgrade rubygem-fast_gettextUpgrade rubygem-amazing_printUpgrade rubygem-powerbarUpgrade rubygem-gssapiUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-little-pluggerUpgrade rubygem-localeUpgrade rubygem-apipie-bindingsUpgrade rubygem-foreman_maintainUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unfUpgrade rubygem-jwtUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_extUpgrade rubygem-mime-types-dataUpgrade python39-pulp_manifestUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-ffi-debuginfoUpgrade rubygem-domain_nameUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli | Nov 13, 2023 | Dec 16, 2022 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-utils-debuginfo | Mar 5, 2024 | Dec 16, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub