CVE-2012-1145 Missing authorization in n/a

What is CVE-2012-1145?

CVE-2012-1145 is a medium-severity missing authorization vulnerability in Redhat Satellite, published on 16 Jun 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause a denial of service (/var partition disk consumption and failed updates) via a large number of package uploads.

Weakness: CWE-287

Which versions are affected by CVE-2012-1145?

It affects 1 product.

Products include Redhat Satellite.

How do I fix CVE-2012-1145?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2012-1145 being exploited?

There is no known exploitation of CVE-2012-1145 in the wild and no public exploit code.

Other vulnerabilities in Redhat Satellite

• CVE-2024-7012 Puppet-foreman: an authentication bypass vulnerability exists in foreman Critical 9.8
• CVE-2024-7923 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore Critical 9.8
• CVE-2026-96659 Foreman: excessive permissions for viewer role on preview Critical 9.1
• CVE-2023-0118 Foreman: arbitrary code execution through templates Critical 9.1
• CVE-2008-2369 Hardcoded credentials in n/a Critical 9.1

All Redhat Satellite vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c32r-w7r9-9w44, RHSA-2012:0436.