CVE-2010-2236 - OpenCVE

The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0, and Proxy 5.3.0, allows remote authenticated users with permissions to administer monitoring probes to execute arbitrary code via unspecified vectors, related to backticks.

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:S/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Redhat	Satellite Spacewalk-java Network Proxy

Configuration 1 [-]

OR	cpe:2.3:a:redhat:network_proxy:5.3:::::::*
	cpe:2.3:a:redhat:satellite:4.0:::::::*
	cpe:2.3:a:redhat:satellite:4.1:::::::*
	cpe:2.3:a:redhat:satellite:4.2:::::::*
	cpe:2.3:a:redhat:satellite:5.1:::::::*
	cpe:2.3:a:redhat:satellite:5.2:::::::*
	cpe:2.3:a:redhat:satellite:5.3:::::::*
	cpe:2.3:a:redhat:spacewalk-java::::::::

References

Link	Resource
http://secunia.com/advisories/56952	Vendor Advisory
https://bugzilla.redhat.com/attachment.cgi?id=819987&action=diff
https://bugzilla.redhat.com/show_bug.cgi?id=607712
https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13f	Exploit Patch
https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=c41c87a9dc9dac771eb761dd63ada05b2f9104f9	Exploit Patch
https://www.suse.com/support/update/announcement/2014/suse-su-20140222-1.html

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: redhat

Published: 2014-04-15T18:00:00

Updated: 2014-04-15T17:57:01

Reserved: 2010-06-09T00:00:00

Link: CVE-2010-2236

JSON object: View

NVD Information

Status : Analyzed

Published: 2014-04-15T23:55:07.203

Modified: 2022-02-03T16:26:48.337

Link: CVE-2010-2236

JSON object: View

Redhat Information

No data.

CWE

CWE-20

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:network_proxy:5.3:*:*:*:*:*:*:*", "matchCriteriaId": "FD54BC7C-AD07-41B7-B2E1-A12361F16BC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:satellite:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "F7342B50-2EB5-4B1D-8B7B-B3EF0CB57344", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:satellite:4.1:*:*:*:*:*:*:*", "matchCriteriaId": "78224C92-8BA1-4717-9DE4-4CC74B5E80FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:satellite:4.2:*:*:*:*:*:*:*", "matchCriteriaId": "2E1C5E62-E685-44F0-9AB3-B8C6BDA7E315", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:satellite:5.1:*:*:*:*:*:*:*", "matchCriteriaId": "4E90E312-ED12-4EBB-AA88-603C91AF2BE9", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:satellite:5.2:*:*:*:*:*:*:*", "matchCriteriaId": "3CDDEC74-7E97-4498-A136-B270BD1AC72D", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:satellite:5.3:*:*:*:*:*:*:*", "matchCriteriaId": "D1FDDB68-9828-4DAF-8417-4E3B68ABA2C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:spacewalk-java:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF0E732F-CA6D-4AE5-AC20-46DB629B1C95", "versionEndIncluding": "2.1.147-1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0, and Proxy 5.3.0, allows remote authenticated users with permissions to administer monitoring probes to execute arbitrary code via unspecified vectors, related to backticks."}, {"lang": "es", "value": "La consola de sensores de monitorizaci\u00f3n en spacewalk-java anterior a 2.1.148-1 y Red Hat Network (RHN) Satellite 4.0.0 hasta 4.2.0 y 5.1.0 hasta 5.3.0 y Proxy 5.3.0, permite a usuarios remotos autenticados con permisos para administrar sensores de monitorizaci\u00f3n ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores no especificados, relacionado con backticks."}], "id": "CVE-2010-2236", "lastModified": "2022-02-03T16:26:48.337", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-04-15T23:55:07.203", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/56952"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/attachment.cgi?id=819987&action=diff"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=607712"}, {"source": "secalert@redhat.com", "tags": ["Exploit", "Patch"], "url": "https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13f"}, {"source": "secalert@redhat.com", "tags": ["Exploit", "Patch"], "url": "https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=c41c87a9dc9dac771eb761dd63ada05b2f9104f9"}, {"source": "secalert@redhat.com", "url": "https://www.suse.com/support/update/announcement/2014/suse-su-20140222-1.html"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}