Vulnerability · Published Dec 18, 2023 · Assigned by redhat
CVE-2023-4320Satellite: arithmetic overflow in satellite
High 7.6
In plain English
A high-severity security flaw in Red Hat Satellite 6.15 for RHEL 8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.7%top 48.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Satellite 6.15 for RHEL 8 | see references |
| Red Hat | Red Hat Satellite 6.15 for RHEL 8 | see references |
| Red Hat | Red Hat Satellite 6.15 for RHEL 8 | see references |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
References
- RHSA-2024:2010 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-4320 vdb-entry, x_refsource_REDHAT
- RHBZ#2231814 issue-tracking, x_refsource_REDHAT