Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2013-4480: Red Hat Satellite lets remote attackers create admin accounts

CVE-2013-4480 · published 12 years ago

Summary

The web setup page in Red Hat Satellite 5.6 and earlier remains active, permitting anyone on the network to add a new administrator. This can give unauthorized users full control over your satellite management system. Disable the setup interface or upgrade to a newer version that removes the page.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
redhat	network_satellite	<= 5.6 `cpe:2.3:a:redhat:network_satellite::::::::`
redhat	satellite	<= 5.6 `cpe:2.3:a:redhat:satellite::::::::`
redhat	satellite_with_embedded_oracle	5.2 5.3 5.4 5.5 `cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.2:::::::*`
suse	manager	1.7 `cpe:2.3:a:suse:manager:1.7:::::::*`
suse	linux_enterprise	11.0 `cpe:2.3:o:suse:linux_enterprise:11.0:sp2::::::`

Original advisory text

Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator accounts.

References

http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00009.html Mailing List Patch Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1513.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1514.html Vendor Advisory
https://access.redhat.com/site/articles/539283 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1024614 Issue Tracking Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

2% chance of attack within 30 days

Type

CWE-668Exposure of Resource to Wrong Sphere

Timeline

Published18 Nov 2013

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2013-4480 · NVD

Track software like this

Free during beta