CVE-2023-3899

HighCVSS 7.8/10Last modified Nov 7, 2026

Description

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285CWE-863

Affected software

VendorProductVersions
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.1 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.2 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 6—

References

Timeline

Published
Aug 23, 2023
Last modified
Nov 7, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-389904.3An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus creCVE-2023-389915.4An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete modelCVE-2023-389929.8jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.CVE-2023-389947.8The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the CVE-2023-389959.8An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command.CVE-2023-389966.7An issue in all versions of Douran DSGate allows a local authenticated privileged attacker to execute arbitrary code via the debug command.CVE-2023-389977.2A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23CVE-2023-389986.1An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirectCVE-2023-389996.5A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition befCVE-2023-39007.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 beforeCVE-2023-390006.1A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 anCVE-2023-390019.8A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.
CVE-2023-3899: High severity, CVSS 7.8 | Vulnix