CVE-2012-0059

MediumCVSS 4.9/10Last modified Nov 5, 2026

Description

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the unauthorized disclosure of user passwords.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-209 CWE-310

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Network Proxy v 5.4	—
Red Hat	Red Hat Network Satellite Server v 5.4	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 7	—

References

http://rhn.redhat.com/errata/RHSA-2012-0101.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-0102.htmlVendor Advisory
https://access.redhat.com/errata/RHSA-2012:0101
https://access.redhat.com/errata/RHSA-2012:0102
https://access.redhat.com/security/cve/CVE-2012-0059
http://rhn.redhat.com/errata/RHSA-2012-0101.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-0102.htmlVendor Advisory

Timeline

Published: Feb 5, 2014
Last modified: Nov 5, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-00606.8RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly e CVE-2012-00616.8The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote atta CVE-2012-00625.8Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent reg CVE-2012-00638.1Insecure plugin update mechanism in tucan through 0.3.10 could allow remote attackers to perform man-in-the-middle attacks and execute arbit CVE-2012-00644.6xkeyboard-config before 2.5 in X.Org before 7.6 enables certain XKB debugging functions by default, which allows physically proximate attack CVE-2012-00654.6Heap-based buffer overflow in the receive_packet function in libusbmuxd/libusbmuxd.c in usbmuxd 1.0.5 through 1.0.7 allows physically proxim CVE-2012-00664.3Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long pac CVE-2012-00674.3wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application CVE-2012-00684.3The lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause CVE-2012-00697.5SQL injection vulnerability in ajax.php in Batavi before 1.2.1 allows remote attackers to execute arbitrary SQL commands via the boxToReload CVE-2012-00707.5spamdyke prior to 4.2.1: STARTTLS reveals plaintext CVE-2012-00714.3Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote attack