CVE-2012-3503

CVE-2012-3503 describes a critical vulnerability in Katello 1.0 and earlier, affecting Red Hat Enterprise Linux Server and TheForeman Katello installations. The flaw stems from the installation script failing to properly generate a unique Application.config.secret_token, leading to all default installations sharing the same secret. This allows remote attackers to authenticate as any user to the CloudForms System Engine web interface by crafting a cookie with the known default secret. The vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. It is classified under CWE-798 (Use of Hard-coded Credentials). While there is no evidence of active exploitation (not in KEV), and no public exploit code is available on Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness among security researchers.