PT-2015-6112 · Foreman · Foreman

Dominic Cleal + 1 · Publicado 2015-08-14 · Atualizado 2023-02-13 · CVE-2015-3235

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.9.0

Description The issue allows remote authenticated users with the edit users permission to edit administrator users and change their passwords. An attacker with the edit users permission could use this flaw to access an admin user account, leading to an escalation of privileges.

Recommendations For Foreman versions prior to 1.9.0, update to version 1.9.0 or later to resolve the issue. As a temporary workaround, consider restricting the edit users permission to prevent unauthorized users from editing administrator accounts.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-3235

RHSA-2015:1591

RHSA-2015:1592

Produtos afetados

Foreman

Referências · 7

• https://bugzilla.redhat.com/show_bug.cgi?id=1232366 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3235 · Nota de Segurança
• https://t.me/cvenotify/43488 · Publicação no Telegram
• https://access.redhat.com/errata/RHSA-2015:1592 · Aviso do Fabricante
• http://theforeman.org/manuals/1.9/index.html#Releasenotesfor1.9 · Nota
• https://access.redhat.com/errata/RHSA-2015:1591 · Aviso do Fabricante
• http://projects.theforeman.org/issues/10829 · Aviso do Fabricante