CVE-2013-6439

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-6439
Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors.

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2013-1863.html Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1042677
https://exchange.xforce.ibmcloud.com/vulnerabilities/90134
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:subscription_asset_manager:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:subscription_asset_manager:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:subscription_asset_manager:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:subscription_asset_manager:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:subscription_asset_manager:1.3.0:*:*:*:*:*:*:*
History

13 Feb 2023, 04:50

Type Values Removed Values Added
Summary CVE-2013-6439 candlepin: insecure authentication enabled by default Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:1863', 'name': 'https://access.redhat.com/errata/RHSA-2013:1863', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2013-6439', 'name': 'https://access.redhat.com/security/cve/CVE-2013-6439', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:15

Type Values Removed Values Added
Summary Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors. CVE-2013-6439 candlepin: insecure authentication enabled by default
References
  • (MISC) https://access.redhat.com/errata/RHSA-2013:1863 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2013-6439 -
Information

Published : 2013-12-23 22:55

Updated : 2023-12-10 11:16

NVD link : CVE-2013-6439

Mitre link : CVE-2013-6439

CVE.ORG link : CVE-2013-6439

JSON object : View

Products Affected

redhat

  • subscription_asset_manager
CWE
CWE-287

Improper Authentication