CVE-2009-4139
Full vulnerability record from the local CVENow database.
Description
A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.
Severity
MEDIUM
CVSS score
6.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2011-07-27 02:55:01.243000
Last modified
2026-10-30 19:17:23.847000
View original CVE JSON
{
"id": "CVE-2009-4139",
"sourceIdentifier": "[email protected]",
"published": "2011-07-27T02:55:01.243",
"lastModified": "2026-10-30T19:17:23.847",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access."
},
{
"lang": "es",
"value": "Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en los paquetes Spacewalk Java (spacewalk-java) 1.2.39 de Spacewalk, tal como se utiliza en el servidor de Red Hat Network Satellite 5.3.0 hasta la versión 5.4.1 y otros productos, permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para peticiones que (1) deshabilitan la cuenta del usuario actual, (2) añaden cuentas de usuarios, o (3) modifican cuentas de usuarios para tener privilegios administrativos."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Network Satellite Server v 5.4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "spacewalk-java",
"cpes": [
"cpe:/a:redhat:network_satellite:5.4::el5"
],
"versions": [
{
"version": "0:1.2.39-85.el5sat",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhnsd",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhnsd",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.6,
"impactScore": 5.2
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"baseScore": 6.8,
"accessVector": "NETWORK",
"accessComplexity": "MEDIUM",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-346"
}
]
},
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:network_satellite_server:5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "771FCD58-59DF-468C-9AB4-229DA07A0CA2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:network_satellite_server:5.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D64C46C1-A5EB-4476-8DBA-F3C7D0FB5905"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:network_satellite_server:5.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A2DF5F81-B099-4878-9739-D5B3B0E89030"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:spacewalk-java:1.2.39:*:*:*:*:*:*:*",
"matchCriteriaId": "A8CF0A4D-0501-4DEC-AADD-4A157E5960D8"
}
]
}
]
}
],
"references": [
{
"url": "http://securitytracker.com/id?1025674",
"source": "[email protected]"
},
{
"url": "http://www.redhat.com/support/errata/RHSA-2011-0879.html",
"source": "[email protected]",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2011:0879",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2009-4139",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=529483",
"source": "[email protected]"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68074",
"source": "[email protected]"
},
{
"url": "http://securitytracker.com/id?1025674",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.redhat.com/support/errata/RHSA-2011-0879.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=529483",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68074",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}