CVE-2020-14380

Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover

Published Jun 2, 2021 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication to the relevant external authentication source (SSO or Open ID) can claim the privileges of already existing local users of Satellite.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2020-6520 An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication to the relevant external authentication source (SSO or Open ID) can claim the privileges of already existing local users of Satellite.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 4, 2024, 12:46 PM
Reserved
Jun 17, 2020, 12:00 AM
Status
Modified
Published
Jun 2, 2021, 1:15 PM
Modified
Jun 17, 2026, 2:54 AM
Severity
Important
Public date
Aug 31, 2020, 2:44 AM