Skip to content
Fencer Vulns
medium 6.8

CVE-2009-4139 json

Spacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery

published 2011-07-27 15 y ago modified 2026-11-05 4 d ago also EUVD-2009-4109

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.

Patch / fix

  • Red Hat Red Hat Network Satellite Server v 5.4 0:1.2.39-85.el5sat
  • spacewalk-java network satellite 5.4 1.2.39-85.el5sat
  • spacewalk-java-lib network satellite 5.4 1.2.39-85.el5sat
  • spacewalk-taskomatic network satellite 5.4 1.2.39-85.el5sat
  • spacewalk-java-config network satellite 5.4 1.2.39-85.el5sat
  • spacewalk-java-oracle network satellite 5.4 1.2.39-85.el5sat

red hat advisories RHSA-2011:0879

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2009-4139 updated cvss 6.8

spacewalk-java: spacewalk: Red Hat Network Satellite: Spacewalk Java: Privilege escalation via cross-site request forgery

  • Red Hat Enterprise Linux 6 rhnsd Red Hat Enterprise Linux 7 rhnsd
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Satellite 5.4 (RHEL v.5) spacewalk-java 1.2.39-85.el5sat, spacewalk-java-lib 1.2.39-85.el5sat, spacewalk-taskomatic 1.2.39-85.el5sat, spacewalk-java-config 1.2.39-85.el5sat, spacewalk-java-oracle 1.2.39-85.el5sat
    fixed: vendor fix RHSA-2011:0879

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Red Hat Red Hat Network Satellite Server v 5.4
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.