CVE-2019-10137

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-02 · updated 2026-06-17
Weakness: CWE-22

Description

A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process.

Affected products

Red Hat Satellite 6: 5.0
spacewalkproject spacewalk: through 2.9

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137

Get alerted when CVE-2019-10137 or the next vulnerability affects your stack