What’s Vulnerable › Vulnerabilities

CVE-2009-4139: Spacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2011-07-27 · updated 2026-10-30
• Weakness: CWE-346

Description

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.

Affected products

• RedHat Network Satellite Server: 5.3.0, 5.4.0, 5.4.1 (and their updates)
• RedHat Spacewalk-Java: 1.2.39 (and their updates)
• Red Hat Network Satellite Server v 5.4: all versions — fixed in 0:1.2.39-85.el5sat

How to fix

Upgrade to a fixed version: Red Hat Network Satellite Server v 5.4 0:1.2.39-85.el5sat. Check the vendor advisory for mitigations.

References

• http://securitytracker.com/id?1025674
• http://www.redhat.com/support/errata/RHSA-2011-0879.html
• https://access.redhat.com/errata/RHSA-2011:0879
• https://access.redhat.com/security/cve/CVE-2009-4139
• https://bugzilla.redhat.com/show_bug.cgi?id=529483
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68074
• http://securitytracker.com/id?1025674
• http://www.redhat.com/support/errata/RHSA-2011-0879.html
• https://bugzilla.redhat.com/show_bug.cgi?id=529483
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68074

Get alerted when CVE-2009-4139 or the next vulnerability affects your stack