CVE-2013-2056

HighCVSS 7.5/10Last modified Oct 30, 2026

Description

A flaw was found in Red Hat Network Satellite. The Inter-Satellite Sync (ISS) operation, which synchronizes data between satellites, does not properly verify the authenticity of clients. This allows remote attackers to bypass the initial authentication process and obtain sensitive channel content. This vulnerability leads to unauthorized information disclosure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306 CWE-287

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Network Satellite Server v 5.3	—
Red Hat	Red Hat Network Satellite Server v 5.4	—
Red Hat	Red Hat Network Satellite Server v 5.5	—
Red Hat	Red Hat Satellite 6	—

References

http://rhn.redhat.com/errata/RHSA-2013-0848.htmlVendor Advisory
http://secunia.com/advisories/53487Vendor Advisory
http://www.osvdb.org/93566
https://access.redhat.com/errata/RHSA-2013:0848
https://access.redhat.com/security/cve/CVE-2013-2056
http://rhn.redhat.com/errata/RHSA-2013-0848.htmlVendor Advisory
http://secunia.com/advisories/53487Vendor Advisory
http://www.osvdb.org/93566

Timeline

Published: Jul 31, 2013
Last modified: Oct 30, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-20579.8YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability CVE-2013-20584.7The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a certain non-streaming op CVE-2013-20596.0OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authenticatio CVE-2013-20609.8The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL CVE-2013-20612.6The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive CVE-2013-20626.8Multiple integer overflows in X.org libXp 1.0.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overfl CVE-2013-20636.8Integer overflow in X.org libXtst 1.2.1 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via CVE-2013-20646.8Integer overflow in X.org libxcb 1.9 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vec CVE-2013-20656.4(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native CVE-2013-20666.8Buffer overflow in X.org libXv 1.0.7 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code v CVE-2013-20676.8java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and CVE-2013-20689.4Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to cr