---
id: CVE-2012-4574
title: >-
  Pulp: red hat cloudforms: pulp in red hat cloudforms: information disclosure
  via world-readable configuration file
summary: >-
  A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability
  allows a local user to read the administrative password due to world-readable
  permissions on the `pulp.conf` configuration file. This information disclosure
  coul…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-538
vendor: Red Hat
product: candlepin
affected:
  - candlepin (all versions)
  - gofer (all versions)
  - grinder (all versions)
  - katello (all versions)
  - katello-agent (all versions)
  - katello-certs-tools (all versions)
  - katello-cli (all versions)
  - katello-cli-tests (all versions)
  - katello-configure (all versions)
  - katello-selinux (all versions)
  - pulp (all versions)
  - quartz (all versions)
  - rubygem-apipie-rails (all versions)
  - gofer (all versions)
  - katello-agent (all versions)
  - rhui_for_rhel_6
published: '2013-01-04'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:03:35.367Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2012-4574'
references:
  - url: 'http://osvdb.org/88138'
  - url: 'http://rhn.redhat.com/errata/RHSA-2012-1543.html'
  - url: 'http://secunia.com/advisories/51472'
  - url: 'http://www.securityfocus.com/bid/56819'
  - url: 'https://access.redhat.com/errata/RHBA-2013:0571'
    label: 'RHBA-2013:0571'
  - url: 'https://access.redhat.com/errata/RHSA-2012:1543'
    label: 'RHSA-2012:1543'
  - url: 'https://access.redhat.com/security/cve/CVE-2012-4574'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=872487'
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/80548'
tags:
  - cve.org
epss: 0.00362
epssPercentile: 0.30152
ingestedAt: '2026-11-05T16:24:31.288Z'
---

## Overview

A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to world-readable permissions on the `pulp.conf` configuration file. This information disclosure could enable unauthorized access to sensitive system credentials.

## Affected

- `candlepin (all versions)`
- `gofer (all versions)`
- `grinder (all versions)`
- `katello (all versions)`
- `katello-agent (all versions)`
- `katello-certs-tools (all versions)`
- `katello-cli (all versions)`
- `katello-cli-tests (all versions)`
- `katello-configure (all versions)`
- `katello-selinux (all versions)`
- `pulp (all versions)`
- `quartz (all versions)`
- `rubygem-apipie-rails (all versions)`
- `gofer (all versions)`
- `katello-agent (all versions)`
- `rhui_for_rhel_6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.