Vulnerability record · CVE-2013-2143 · published 17 April 2014
CVE-2013-2143: Katello and Red Hat Satellite missing authorization in update_roles
Redhat · Network Satellite
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action. A remote authenticated user can therefore change a user account to an administrator account, escalating their own or another account's privileges.
Description
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.
AV:N/AC:L/Au:S/C:P/I:P/A:P
Automated analysis
high priorityA remotely reachable missing-authorization flaw with public exploit code and very high EPSS, though it requires an authenticated account and is not in KEV.
What it is
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action. A remote authenticated user can therefore change a user account to an administrator account, escalating their own or another account's privileges.
Impact
An attacker with a low-privileged authenticated account gains administrator privileges on the affected Katello or Satellite instance. That grants full control over the management platform and the systems it manages.
Attack surface
Reached over the network through the users controller update_roles action; the attacker must already be authenticated but no user interaction is required. The CVSS vector AV:N/AC:L/Au:S confirms network reachability with single authentication.
Exploitation
Public exploit code exists (Exploit-DB 32515, Packet Storm, SecurityFocus BID 66434), and EPSS is 0.48221 (98.8th percentile), indicating high likelihood of exploitation. It is not listed in CISA KEV.
What to do
- Upgrade Katello to a version later than 1.5.0-14 and apply the corresponding Red Hat Satellite update.
- Restrict network access to the Katello/Satellite web interface to trusted administrators.
- Audit user accounts and roles for unauthorized administrator assignments.
- Enforce least privilege and review who holds authenticated accounts on the platform.
Detection
- Monitor audit logs for update_roles requests that change a user to an administrator role.
- Alert on role or privilege changes made by accounts that are not designated administrators.
- Review web server logs for POST requests to the users controller update_roles endpoint from unexpected sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-2143 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-2143), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
