CVE-2021-4142

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639 CWE-287

Affected software

Vendor	Product	Versions
n/a	candlepin	Affects v3.1.28-2, v3.2.21-1, v4.1.8-1 and earlier are affected.

References

https://access.redhat.com/security/cve/CVE-2021-4142Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2034346Issue Tracking, Vendor Advisory
https://github.com/candlepin/candlepin/pull/3197Patch, Third Party Advisory
https://github.com/candlepin/candlepin/pull/3198Third Party Advisory
https://github.com/candlepin/candlepin/pull/3199Patch, Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-4142Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2034346Issue Tracking, Vendor Advisory
https://github.com/candlepin/candlepin/pull/3197Patch, Third Party Advisory
https://github.com/candlepin/candlepin/pull/3198Third Party Advisory
https://github.com/candlepin/candlepin/pull/3199Patch, Third Party Advisory

Timeline

Published: Aug 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-414205.4A stored XSS vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker for arbitrary JavaScript code execution in the context o CVE-2021-414214.8A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin pan CVE-2021-414268.8Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt_end_user.htm.CVE-2021-414276.1Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting (XSS) via the choose_mac parameter to setup.cgi.CVE-2021-41436.1Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.CVE-2021-414325.4A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands throu CVE-2021-414339.8SQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application login form by EGavilan M CVE-2021-414345.4A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application that allows for arbitra CVE-2021-414359.8A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, R CVE-2021-414367.5An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, CVE-2021-414376.5An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL t CVE-2021-41448.8TP-Link wifi router TL-WR802N V4(JP), with firmware version prior to 211202, is vulnerable to OS command injection.