VulnerabilityModified
CVE-2022-4130
A blind site-to-site request forgery vulnerability was found in Satellite server.
MEDIUM 4.5EPSS 0.67%
Does this matter?
Lower severity and a low EPSS score (0.67%). Track it; it rarely justifies an emergency change on its own.
Description
A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external interaction to an attacker's server by modifying the Referer header in an HTTP request of specific resources in the server.
- CVSS 3.1
- 4.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 0.67% probability · 50th percentile
- CISA KEV
- Not listed
- Affected
- redhat/satellite
- Source
- secalert@redhat.com
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2145254Issue Tracking, Permissions Required, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2145254Issue Tracking, Permissions Required, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.