CVEvulnerability

CVE-2012-3503

9.8 CRITICAL Published 2012-08-25 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-08-25
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-798

Description

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.

Affected configurations

• theforeman katello (<= 1.0) • redhat enterprise linux server 6.0

Related

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

Referenced by CWE · observed example (2)

  • CWE-1391 Use of Weak Credentials weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References