CVE-2022-4130

MEDIUM

Red Hat Satellite - Server-Side Request Forgery via Referer Header

Title source: llm

Description

A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external interaction to an attacker's server by modifying the Referer header in an HTTP request of specific resources in the server.

References (1)

Core 1

Core References

Issue Tracking, Permissions Required, Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2145254

Scores

CVSS v3 4.5

EPSS 0.0014

EPSS Percentile 33.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

Status published

Products (3)

redhat/satellite 6.9

redhat/satellite 6.10

redhat/satellite 6.11

Published Dec 16, 2022

Tracked Since Feb 18, 2026