VULNERABILITY INTELLIGENCE

CVE-2012-3503

CVSS score9.8 CRITICAL
EPSS probability3.00%
CISA KEVNot currently listed
Published2012-08-25
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.

Weakness classification

  • CWE-798: Use of Hard-coded Credentials

Primary references