CVE-2020-1693

2020-02-1720:15:11

Google

osv.dev

8 High

AI Score

Confidence

High

0.035 Low

EPSS

Percentile

91.6%

JSON

A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbitrary code on the Spacewalk server.

CPENameOperatorVersion
spacewalkeqrhn-client-tools-1.2.4-1
spacewalkeqspacewalk-web-1.1.6-1
spacewalkeqspacewalk-java-2.5.98-1
spacewalkeqspacewalk-schema-1.10.32-1
spacewalkeqspacewalk-schema-1.6.30-1
spacewalkeqspacewalk-backend-2.9.32-1
spacewalkeqapt-spacewalk-1.0.15-1
spacewalkeqosad-5.9.29-1
spacewalkeqspacewalk-java-1.8.51-1
spacewalkeqSatConfig-general-1.215.46-1

Name	Operator	Version
spacewalk	eq	rhn-client-tools-1.2.4-1
spacewalk	eq	spacewalk-web-1.1.6-1
spacewalk	eq	spacewalk-java-2.5.98-1
spacewalk	eq	spacewalk-schema-1.10.32-1
spacewalk	eq	spacewalk-schema-1.6.30-1
spacewalk	eq	spacewalk-backend-2.9.32-1
spacewalk	eq	apt-spacewalk-1.0.15-1
spacewalk	eq	osad-5.9.29-1
spacewalk	eq	spacewalk-java-1.8.51-1
spacewalk	eq	SatConfig-general-1.215.46-1