CVE-2018-10866 - redhat-certification: remove a "system" file without authorization

Back Back to CVE browser

CRITICAL

redhat-certification: remove a "system" file without authorization

Published May 26, 2021

9.1

CRITICAL

CVSS 3.1

EPSS 1.04%

Description

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remove a "system" file, that is an xml file with host related information, not belonging to him.

Affected products

Vendor n/a Product Redhat-Certification Default
n/a
- Version
  redhat-certification 7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Redhat-Certification

n/a

Version	Status	Constraints
redhat-certification 7	affected	-

Red Hat Certification for Red Hat Enterprise Linux 6

redhat-certification

Not affected
Red Hat Certification for Red Hat Enterprise Linux 7

redhat-certification

Affected

Product	Package	State	Advisory
Red Hat Certification for Red Hat Enterprise Linux 6	redhat-certification	Not affected	n/a
Red Hat Certification for Red Hat Enterprise Linux 7	redhat-certification	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (4)

https://access.redhat.com/security/cve/CVE-2018-10866
x_refsource_MISCVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1593632
x_refsource_MISCIssue TrackingVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-10866
https://www.cve.org/CVERecord?id=CVE-2018-10866

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-10866		x_refsource_MISCVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1593632		x_refsource_MISCIssue TrackingVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-10866
https://www.cve.org/CVERecord?id=CVE-2018-10866