CVE-2023-1832: falha de média gravidade em candlepin-4.3.7
Improper authorization check in the server component
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.6%
An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
CVEs relacionadas — candlepin-4.3.7
No mesmo produto, das mais perigosas para as menos.
CVE-2013-2056HIGHRed hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypassEPSS 2.6%CVE-2022-3874HIGHOs command injection via ct_command and fcct_commandEPSS 2.2%CVE-2026-1961HIGHForman: foreman: remote code execution via command injection in websocket proxyEPSS 1.9%CVE-2026-12405HIGHRubygem-foreman_remote_execution: command injection in job invocations via effective_user parameterEPSS 1.6%CVE-2026-89059HIGHResteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)EPSS 1.5%CVE-2011-4346MEDIUMSatellite: xss in custom system information key handlingEPSS 1.2%