6.5 Medium

CVE-2011-1594 Spacewalk: spacewalk: open redirect vulnerability enables phishing attacks via url parameter

Description

A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the url_bounce parameter. This can enable attackers to conduct phishing attacks, potentially leading to unauthorized information disclosure or credential theft.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
n/a	Versions not published
Red Hat Enterprise Linux 6	Versions not published
Red Hat Enterprise Linux 7	Versions not published
Red Hat Network Satellite Server v 5.4	Versions not published

References

www.redhat.com www.redhat.com
RHSA-2011:1299 access.redhat.com
access.redhat.com access.redhat.com
bugzilla.redhat.com bugzilla.redhat.com
www.redhat.com www.redhat.com

Timeline

Published February 5, 2014
Last modified November 5, 2026

The 144658 CVEs of n/a →

CVE-2026-106713 An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the… Not rated CVE-2026-106715 NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin… Not rated CVE-2026-106714 Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it… Not rated CVE-2026-106716 ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep… Not rated

Track this CVE