CVE-2021-3413 Information disclosure in Satellite
Attackers can expose Azure Resource Manager secret keys via API output, compromising confidentiality, integrity, and availability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3413?
CVE-2021-3413 is a medium-severity vulnerability in Redhat Satellite, published on 8 Apr 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was identified which will expose Azure Resource Manager's secret key through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Weakness: CWE-200
Which versions are affected by CVE-2021-3413?
It affects 2 products.
Products include Redhat Satellite, Theforeman Foreman Azurerm.
How do I fix CVE-2021-3413?
Upgrade to a fixed version.
Is CVE-2021-3413 being exploited?
There is no known exploitation of CVE-2021-3413 in the wild and no public exploit code.
Other vulnerabilities in Redhat Satellite
- CVE-2024-7012 Puppet-foreman: an authentication bypass vulnerability exists in foreman
- CVE-2024-7923 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
- CVE-2026-96659 Foreman: excessive permissions for viewer role on preview
- CVE-2023-0118 Foreman: arbitrary code execution through templates
- CVE-2008-2369 Hardcoded credentials in n/a
Sources
Also known as GHSA-gphm-f2cq-m9pv.