Read the docs
TI-2013-03929 Aliases CVE-2013-4480GHSA-6g3j-mch3-9577

Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to…

Priority LOW 37CWE-668Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remote attackers to create administrator accounts.

Why it matters now

EPSS 0.02076 81st percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:redhat:network_satellite:*:*:*:*:*:*:*:*up to 5.6VulnerableRed Hat
cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*up to 5.6VulnerableRed Hat
cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.2:*:*:*:*:*:*:*5.2VulnerableRed Hat
cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.3:*:*:*:*:*:*:*5.3VulnerableRed Hat
cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.4:*:*:*:*:*:*:*5.4VulnerableRed Hat
cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.5:*:*:*:*:*:*:*5.5VulnerableRed Hat
cpe:2.3:a:suse:manager:1.7:*:*:*:*:*:*:*1.7VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise:11.0:sp2:*:*:*:*:*:*11.0 sp2VulnerableSUSE
  • cpe:2.3:a:redhat:network_satellite:*:*:*:*:*:*:*:* Versions up to 5.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:* Versions up to 5.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.2:*:*:*:*:*:*:* Versions 5.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.3:*:*:*:*:*:*:* Versions 5.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.4:*:*:*:*:*:*:* Versions 5.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.5:*:*:*:*:*:*:* Versions 5.5 Vulnerable ·Red Hat
  • cpe:2.3:a:suse:manager:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise:11.0:sp2:*:*:*:*:*:* Versions 11.0 sp2 Vulnerable ·SUSE

Remediation

Red Hat 2 advisories

  • RHSA-2013:1514 Released 2013-11-12 · Red Hat rating Critical
    spacewalk-java security update
    • Red Hat Satellite 5.3 (RHEL v.5) spacewalk-java-0.5.44-97.el5sat, spacewalk-java-config-0.5.44-97.el5sat, spacewalk-java-lib-0.5.44-97.el5sat +1
    • Red Hat Satellite 5.4 (RHEL v.5) spacewalk-java-1.2.39-135.el5sat, spacewalk-java-config-1.2.39-135.el5sat, spacewalk-java-lib-1.2.39-135.el5sat +2
    • Red Hat Satellite 5.4 (RHEL v.6) spacewalk-java-1.2.39-135.el6sat, spacewalk-java-config-1.2.39-135.el6sat, spacewalk-java-lib-1.2.39-135.el6sat +2
    • Red Hat Satellite 5.5 (RHEL v.5) spacewalk-java-1.7.54-121.el5sat, spacewalk-java-config-1.7.54-121.el5sat, spacewalk-java-lib-1.7.54-121.el5sat +2
    • Red Hat Satellite 5.5 (RHEL v.6) spacewalk-java-1.7.54-121.el6sat, spacewalk-java-config-1.7.54-121.el6sat, spacewalk-java-lib-1.7.54-121.el6sat +2
    • Red Hat Satellite 5.6 (RHEL v.5) spacewalk-java-2.0.2-48.el5sat, spacewalk-java-config-2.0.2-48.el5sat, spacewalk-java-lib-2.0.2-48.el5sat +3
    • Red Hat Satellite 5.6 (RHEL v.6) spacewalk-java-2.0.2-48.el6sat, spacewalk-java-config-2.0.2-48.el6sat, spacewalk-java-lib-2.0.2-48.el6sat +3
  • RHSA-2013:1513 Released 2013-11-12 · Red Hat rating Critical
    rhn-java-sat security update
    • Red Hat Satellite 5.2 (RHEL v.5) rhn-java-config-sat-5.2.1-9.el5, rhn-java-lib-sat-5.2.1-9.el5, rhn-java-sat-5.2.1-9.el5 +1

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 5.2 (RHEL v.5)Fixed RHSA-2013:1513
Red Hat Satellite 5.3 (RHEL v.5)Fixed RHSA-2013:1514
Red Hat Satellite 5.4 (RHEL v.5)Fixed RHSA-2013:1514
Red Hat Satellite 5.4 (RHEL v.6)Fixed RHSA-2013:1514
Red Hat Satellite 5.5 (RHEL v.5)Fixed RHSA-2013:1514
Red Hat Satellite 5.5 (RHEL v.6)Fixed RHSA-2013:1514
Red Hat Satellite 5.6 (RHEL v.5)Fixed RHSA-2013:1514
Red Hat Satellite 5.6 (RHEL v.6)Fixed RHSA-2013:1514

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4480
  2. 2026-10-03 Alias added: GHSA-6g3j-mch3-9577

References

Patch 1

Advisory 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences