CVE-2024-12293: Cross-Site Request Forgery (CSRF)

The User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.64.3. This is due to missing or incorrect nonce validation on the updateroles function. This makes it possible for unauthenticated attackers to add or remove roles for...

Privilege Escalation

Katello is vulnerable to privilege escalation. The library does not check for permission for the updateroles function, allowing a malicious user to upgrade a user account to administrator level privileges...

Katello update_roles Privilege Escalation (CVE-2013-2143)

A privilege escalation vulnerability has been reported in Katello. The vulnerability is due to a missing authorization at the "updateroles" action of "users" controller. A remote authenticated attacker may exploit this vulnerability to gain administrator privileges...

Authorization

The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the updateroles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account...

CVE-2013-2143: Improper Input Validation

The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the updateroles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account...