CVE-2013-4480

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator accounts.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00009.htmlMailing List, Patch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1513.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1514.htmlVendor Advisory
https://access.redhat.com/site/articles/539283Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1024614Issue Tracking, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00009.htmlMailing List, Patch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1513.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1514.htmlVendor Advisory
https://access.redhat.com/site/articles/539283Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1024614Issue Tracking, Vendor Advisory

Timeline

Published: Nov 18, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-44811.9Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which a CVE-2013-44826.2Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local user CVE-2013-44834.9The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local use CVE-2013-44845.0Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET reque CVE-2013-44854.0389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of servic CVE-2013-44869.8Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging CVE-2013-44875.0Off-by-one error in the dane_raw_tlsa in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote serve CVE-2013-44884.3libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers.CVE-2013-44896.5The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary comma CVE-2013-44906.5The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allow CVE-2013-44914.3Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component i CVE-2013-44924.3Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary