← Vulnerability feed
Start free
Open in platform
Vulnerability record · CVE-2013-4120 · published 10 December 2019
CVE-2013-4120: Theforeman katello uncontrolled resource consumption vulnerability
Theforeman · Katello
Katello has a Denial of Service vulnerability in API OAuth authentication
7.5 CVSS 3.1 High EPSS 1.3% · top 30.6% CWE-400 · Uncontrolled resource consumption
7.5CVSS 3.1 base score, v2 5.0
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
16 Jun 2026Last modified by NVD
Description
Katello has a Denial of Service vulnerability in API OAuth authentication
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://access.redhat.com/security/cve/cve-2013-4120 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4120 | Issue TrackingThird Party Advisory |
| https://access.redhat.com/security/cve/cve-2013-4120 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4120 | Issue TrackingThird Party Advisory |
Track CVE-2013-4120 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
9.8CVE-2012-3503Theforeman katello hard-coded credentials vulnerabilityThe installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default in…EPSS 3.0%6.5CVE-2013-2143Katello and Red Hat Satellite missing authorization in update_rolesThe users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action. A remote authe…EPSS 48%analysed5.5CVE-2016-9595Theforeman katello link following vulnerabilityA flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this fla…EPSS 0.40%5.4CVE-2013-0283Theforeman katello cross-site scripting vulnerabilityKatello: Username in Notification page has cross site scriptingEPSS 0.55%5.4CVE-2013-2101Theforeman katello cross-site scripting vulnerabilityKatello has multiple XSS issues in various entitiesEPSS 0.55%5.4CVE-2018-16887Redhat satellite cross-site scripting vulnerabilityA cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locati…EPSS 1.00%4.3CVE-2018-14623Theforeman katello sql injection vulnerabilityA SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query …EPSS 1.4%4.3CVE-2017-2662Theforeman katello missing authorization vulnerabilityA flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter…EPSS 0.94%
Source: NIST National Vulnerability Database (record CVE-2013-4120), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.
