CVE-2010-2236

The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0, and Proxy 5.3.0, allows remote authenticated users with permissions to administer monitoring probes to execute arbitrary code via unspecified vectors, related to backticks.

CVSS v2.0 6.0 MEDIUM

6.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/attachment.cgi?id=819987&action=diff
http://secunia.com/advisories/56952	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=607712
https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=c41c87a9dc9dac771eb761dd63ada05b2f9104f9	Exploit Patch
https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13f	Exploit Patch
https://www.suse.com/support/update/announcement/2014/suse-su-20140222-1.html

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:satellite:4.0:::::::*
	cpe:2.3:a:redhat:satellite:4.2:::::::*
	cpe:2.3:a:redhat:satellite:5.3:::::::*
	cpe:2.3:a:redhat:spacewalk-java::::::::
	cpe:2.3:a:redhat:network_proxy:5.3:::::::*
	cpe:2.3:a:redhat:satellite:5.1:::::::*
	cpe:2.3:a:redhat:satellite:5.2:::::::*
	cpe:2.3:a:redhat:satellite:4.1:::::::*

Information

Published : 2014-04-15 16:55

Updated : 2022-02-03 08:26

NVD link : CVE-2010-2236

Mitre link : CVE-2010-2236

JSON object : View

CWE

CWE-20

Improper Input Validation

Advertisement

Products Affected

redhat

spacewalk-java
network_proxy
satellite

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://bugzilla.redhat.com/attachment.cgi?id=819987&action=diff", "name": "https://bugzilla.redhat.com/attachment.cgi?id=819987&action=diff", "tags": [], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/56952", "name": "56952", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=607712", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=607712", "tags": [], "refsource": "CONFIRM"}, {"url": "https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=c41c87a9dc9dac771eb761dd63ada05b2f9104f9", "name": "https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=c41c87a9dc9dac771eb761dd63ada05b2f9104f9", "tags": ["Exploit", "Patch"], "refsource": "CONFIRM"}, {"url": "https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13f", "name": "https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13f", "tags": ["Exploit", "Patch"], "refsource": "CONFIRM"}, {"url": "https://www.suse.com/support/update/announcement/2014/suse-su-20140222-1.html", "name": "SUSE-SU-2014:0222", "tags": [], "refsource": "SUSE"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0, and Proxy 5.3.0, allows remote authenticated users with permissions to administer monitoring probes to execute arbitrary code via unspecified vectors, related to backticks."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2010-2236", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-04-15T23:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:satellite:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:satellite:4.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:satellite:5.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:spacewalk-java:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.1.147-1"}, {"cpe23Uri": "cpe:2.3:a:redhat:network_proxy:5.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:satellite:5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:satellite:5.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:satellite:4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-02-03T16:26Z"}