The installation script in Katello 1.0 and previous versions does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote malicious users to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
theforeman katello |
||
redhat enterprise linux server 6.0 |
Vulmon