Spacewalk

This hub aggregates every CVE we track for Spacewalk, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 13 most recently published vulnerabilities affecting Spacewalk.

• CVE-2021-40348Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. T...8.8Nov 1, 2021
• CVE-2020-1693A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve ...8.6Feb 17, 2020
• CVE-2019-10136It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits arou...4.3Jul 2, 2019
• CVE-2019-10137A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the...8.1Jul 2, 2019
• CVE-2017-7470It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py.6.5Jul 27, 2018
• CVE-2018-1077Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.7.5Mar 14, 2018
• CVE-2014-7812Cross-site scripting (XSS) vulnerability in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allows remote authenticated users to inject arbitrary web script or HTML via the System Groups...3.5Jan 15, 2015
• CVE-2014-7811Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite before 5.7.0 allow remote authenticated users to inject arbitrary web script or HTML via crafted...3.5Jan 15, 2015
• CVE-2011-3344Spacewalk: spacewalk: cross-site scripting via uri in lookup login/password form5.4Feb 5, 2014
• CVE-2011-2920Spacewalk: spacewalk: cross-site scripting vulnerability allows arbitrary web script execution.5.5Feb 5, 2014
• CVE-2011-2927Spacewalk: spacewalk and red hat network satellite: cross-site scripting vulnerability via search forms5.4Feb 5, 2014
• CVE-2011-2919Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the Syst...4.3Feb 5, 2014
• CVE-2011-1594Spacewalk: spacewalk: open redirect vulnerability enables phishing attacks via url parameter6.5Feb 5, 2014