rapid7/metasploit-framework — pull request #3138 by rcvalle (2014-03-25 02:57:08+00:00)
Title: Add katello_satellite_priv_esc.rb

This module exploits a missing authorization vulnerability in the "update_roles" action of "users" controller of Katello and Red Hat Satellite (Katello 1.5.0-14 and earlier) by changing the specified account to an administrator account.