CVE-2012-0059

Spacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messages

State: Published
Severity: 4.9 Medium
Published: Feb 5, 2014
Updated: Oct 30, 2026
Reserved: Dec 7, 2011

Description

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the unauthorized disclosure of user passwords.

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	redhat

Weaknesses

CWE-209 Generation of Error Message Containing Sensitive Information

Affected Products

Product	Versions
Red Hat Network Proxy v 5.4Red Hat	0:1.2.13-66.el5sat and laterNot affected
Red Hat Network Satellite Server v 5.4Red Hat	0:1.2.13-66.el5sat and laterNot affected
Red Hat Enterprise Linux 6Red Hat
Red Hat Enterprise Linux 6Red Hat
Red Hat Enterprise Linux 6Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 7Red Hat

References

http://rhn.redhat.com/errata/RHSA-2012-0101.html
http://rhn.redhat.com/errata/RHSA-2012-0102.html
RHSA-2012:0101vendor-advisory
RHSA-2012:0102vendor-advisory
https://access.redhat.com/security/cve/CVE-2012-0059vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.