PatchTheCVECVE-2015-3163: The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which all
CVE-2015-3163 is a medium-severity flaw (CVSS 4.3) affecting beaker. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via navigating to $BEAKER/powertypes and $BEAKER/keytypes respectively.
Why this priority
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 1.1% (top 34%) |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2017-09-06 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2015-3163?
beaker: upgrade to newer than 19.3. Exact commands for each OS are on this page.
Is CVE-2015-3163 being exploited?
CVE-2015-3163 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2015-3163 affect?
CVE-2015-3163 affects beaker. Severity is medium (CVSS 4.3). The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via navigating to $BEAKER/powertypes and $BEAKER/keytypes respe
How urgent is CVE-2015-3163?
Priority 41/100. Public exploit reference; On your watchlist
Related CVEs
- CVE-2020-12079 CRITICAL 10.0 UPGRADE Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution
- CVE-2015-3162 MEDIUM 5.4 DOWNGRADE Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 al
- CVE-2015-3161 MEDIUM 4.8 UPGRADE The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string li
- CVE-2015-3160 MEDIUM 4.3 UPGRADE XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticate
- CVE-2013-7489 MEDIUM 6.8 UPGRADE The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lea