Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Katello installations share same secret token, enabling unauthorized logins

CVE-2012-3503 · published 14 years ago
Summary

Katello versions 1.0 and earlier create the same secret code during installation. Because the code is identical on every install, an attacker who learns it can craft a special web cookie and sign into the CloudForms System Engine web interface as any user. Upgrade to the latest Katello release or manually replace the secret code with a unique value for each system.

What to do
  • Update n/a katello to version 1.0.6.
  • Update n/a katello to version 1.1.7.
Affected software
Ecosystem VendorProductAffected versions
rubygems n/a katello < 1.0.6
>= 1.1.0, < 1.1.7
Fix: upgrade to 1.0.6
– theforeman katello <= 1.0
cpe:2.3:a:theforeman:katello:*:*:*:*:*:*:*:*
– redhat enterprise_linux_server 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
Original advisory text
Katello uses hard coded credential
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published25 Aug 2012
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-5xv2-q475-rwrh · GHSA
CVE-2012-3503 · NVD
Track software like this
Free during beta