{"id":"CVE-2012-4574","title":"Pulp: red hat cloudforms: pulp in red hat cloudforms: information disclosure via world-readable configuration file","summary":"A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to world-readable permissions on the `pulp.conf` configuration file. This information disclosure coul…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-538"],"vendor":"Red Hat","product":"candlepin","affected":["candlepin (all versions)","gofer (all versions)","grinder (all versions)","katello (all versions)","katello-agent (all versions)","katello-certs-tools (all versions)","katello-cli (all versions)","katello-cli-tests (all versions)","katello-configure (all versions)","katello-selinux (all versions)","pulp (all versions)","quartz (all versions)","rubygem-apipie-rails (all versions)","gofer (all versions)","katello-agent (all versions)","rhui_for_rhel_6"],"published":"2013-01-04","updated":"2026-10-30","sourceUpdated":"2026-10-30T18:03:35.367Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2012-4574","references":[{"url":"http://osvdb.org/88138"},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1543.html"},{"url":"http://secunia.com/advisories/51472"},{"url":"http://www.securityfocus.com/bid/56819"},{"url":"https://access.redhat.com/errata/RHBA-2013:0571","label":"RHBA-2013:0571"},{"url":"https://access.redhat.com/errata/RHSA-2012:1543","label":"RHSA-2012:1543"},{"url":"https://access.redhat.com/security/cve/CVE-2012-4574"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=872487"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80548"}],"tags":["cve.org"],"epss":0.00362,"epssPercentile":0.30152,"ingestedAt":"2026-11-05T16:24:31.288Z","slug":"CVE-2012-4574","body":"## Overview\n\nA flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to world-readable permissions on the `pulp.conf` configuration file. This information disclosure could enable unauthorized access to sensitive system credentials.\n\n## Affected\n\n- `candlepin (all versions)`\n- `gofer (all versions)`\n- `grinder (all versions)`\n- `katello (all versions)`\n- `katello-agent (all versions)`\n- `katello-certs-tools (all versions)`\n- `katello-cli (all versions)`\n- `katello-cli-tests (all versions)`\n- `katello-configure (all versions)`\n- `katello-selinux (all versions)`\n- `pulp (all versions)`\n- `quartz (all versions)`\n- `rubygem-apipie-rails (all versions)`\n- `gofer (all versions)`\n- `katello-agent (all versions)`\n- `rhui_for_rhel_6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}