CVE-2024-12840

http proxies: Satellite: Service side request forgery in http proxies

View on CVE.org
Published Dec 20, 2024 CVSS 3.1 · 5.0 Medium EPSS n/a KEV · Not listed
Description
Red Hat Product Security has come to the conclusion that this CVE is not needed. The problem described was inteded behavior and therefore not a bug.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-51141 A server-side request forgery exists in Satellite. When a PUT HTTP request is made to /http_proxies/test_connection, when supplied with the http_proxies variable set to localhost, the attacker can fetch the localhost banner.
History
Type Values Removed Values Added
Title Http proxies: satellite: service side request forgery in http proxies http proxies: Satellite: Service side request forgery in http proxies
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A server-side request forgery exists in Satellite. When a PUT HTTP request is made to /http_proxies/test_connection, when supplied with the http_proxies variable set to localhost, the attacker can fetch the localhost banner. Red Hat Product Security has come to the conclusion that this CVE is not needed. The problem described was inteded behavior and therefore not a bug.
CPEs cpe:/a:redhat:satellite:6
Vendors & Products Redhat
Redhat satellite
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Description A server-side request forgery exists in Satellite. When a PUT HTTP request is made to /http_proxies/test_connection, when supplied with the http_proxies variable set to localhost, the attacker can fetch the localhost banner.
Title Http proxies: satellite: service side request forgery in http proxies
First Time appeared Redhat
Redhat satellite
Weaknesses CWE-918
CPEs cpe:/a:redhat:satellite:6
Vendors & Products Redhat
Redhat satellite
References
Metrics cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N'}
Earlier changes (1)

Subscriptions

No data.

Weaknesses

Sources

Status
REJECTED
Assigner
redhat
Published
Updated
May 12, 2025, 8:16 PM
Reserved
Dec 20, 2024, 12:10 PM

View source JSON

Updated

JSON

Status
Rejected
Published
Dec 20, 2024, 4:15 PM
Modified
May 12, 2025, 9:15 PM

View source JSON

Severity
Moderate
Public date
Dec 20, 2024, 12:20 PM

View source Bugzilla JSON

No data.