CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Improper Input Validation
Summary: the users controller in katello 1.5.0-14 and earlier, and red hat satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2014-04-17
Last Modified Date: 2014-04-17