VULNERABILITY INTELLIGENCE

CVE-2009-4139

CVSS score6.8 MEDIUM
EPSS probability0.82%
CISA KEVNot currently listed
Published2011-07-27
Last modified2026-10-30
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Description

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.

Weakness classification

  • CWE-346: Origin Validation Error
  • CWE-352: Cross-Site Request Forgery (CSRF)

Primary references