Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2012-3503

Quick assessment

Affected

n/a n/a

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Katello 1.0版本和之前版本中存在漏洞，可被攻击者利用绕过某些安全限制。该漏洞源于安装脚本使用cookie生成的可预测令牌。攻击者可利用该漏洞绕过web接口身份验证机制并作为任意用户登录。

AI Predicted 9.8 Difficulty: Trivial EPSS 3.00% · P87 Updated Feb 21, 2026

Possible ATT&CK Techniques 1 AI

T1132 · Data Encoding

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2012-3503

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Katello 安全绕过漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	n/a	n/a	-

II. Public POCs for CVE-2012-3503

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2012-3503

请登录查看更多情报信息。

Patches & Fixes for CVE-2012-3503 (2)

https://github.com/Katello/katello/pull/499 x_refsource_CONFIRM
https://github.com/Katello/katello/commit/7c256fef9d75029d0ffff58ff1dcda915056d3a3 x_refsource_CONFIRM

Vendor Advisories for CVE-2012-3503 (4)

🔗 http://secunia.com/advisories/50344 third-party-advisory x_refsource_SECUNIA
http://www.securityfocus.com/bid/55140 vdb-entry x_refsource_BID
http://rhn.redhat.com/errata/RHSA-2012-1186.html vendor-advisory x_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2012-1187.html vendor-advisory x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2012-3503

Same Patch Batch · n/a · 2012-08-25 · 55 CVEs total

CVE-2012-4670		Tigase XMPP Server 安全漏洞
CVE-2012-4667		SquidClamav 多个跨站脚本漏洞
CVE-2012-3481		GIMP 输入验证错误漏洞
CVE-2012-3508		Roundcube Webmail 跨站脚本漏洞
CVE-2012-3507		RoundCube Webmail 跨站脚本漏洞
CVE-2012-3501		SquidClamav URL解析拒绝服务漏洞
CVE-2012-3514		OCaml Xml-Light Library 哈希冲突拒绝服务漏洞
CVE-2012-0048		OpenTTD 拒绝服务漏洞
CVE-2012-4672		Apple iChat服务器安全漏洞
CVE-2012-4671		psyced 安全漏洞
CVE-2012-3402		GIMP 输入验证错误漏洞
CVE-2012-4669		M-Link 安全漏洞
CVE-2012-3525		jabberd XMPP Server Dialback Protection组件安全绕过漏洞
CVE-2010-5184		Check Point ZoneAlarm 竞争条件问题漏洞
CVE-2010-5183		Webroot Internet Security Essentials 竞争条件问题漏洞
CVE-2010-5182		VirusBuster Internet Security Suite 竞争条件问题漏洞
CVE-2010-5181		VIPRE Antivirus Premium 竞争条件问题漏洞
CVE-2010-5180		VirusBlokAda VBA32 竞争条件问题漏洞
CVE-2010-5179		Trend Micro Internet Security Pro 竞争条件问题漏洞
CVE-2010-5178		ThreatFire 竞争条件问题漏洞

Showing top 20 of 55 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a

Same vendor: n/a