CVE-2013-6439

2013-12-2322:55:00

CWE-287

[email protected]

web.nvd.nist.gov

candlepin

red hat

subscription asset manager

cve-2013-6439

weak authentication

configuration vulnerability

nvd

security issue

6.9 Medium

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

72.8%

JSON

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors.

CPENameOperatorVersion
redhat:subscription_asset_managerredhat subscription asset managereq1.1.0
redhat:subscription_asset_managerredhat subscription asset managereq1.0.0
redhat:subscription_asset_managerredhat subscription asset managereq1.2.0
redhat:subscription_asset_managerredhat subscription asset managereq1.2.1
redhat:subscription_asset_managerredhat subscription asset managereq1.3.0

CPE	Name	Operator	Version
redhat:subscription_asset_manager	redhat subscription asset manager	eq	1.1.0
redhat:subscription_asset_manager	redhat subscription asset manager	eq	1.0.0
redhat:subscription_asset_manager	redhat subscription asset manager	eq	1.2.0
redhat:subscription_asset_manager	redhat subscription asset manager	eq	1.2.1
redhat:subscription_asset_manager	redhat subscription asset manager	eq	1.3.0