PT-2016-3676 · Foreman · Foreman

Daniel Lobato Garcia · Publicado 2016-04-11 · Atualizado 2023-02-13 · CVE-2015-5233

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Foreman versions 1.8.0 through 1.8.3 Foreman versions 1.9.0 through 1.9.0

Description The issue allows remote authenticated users with the view reports permission to read reports from arbitrary hosts or remote authenticated users with the destroy reports permission to delete reports from arbitrary hosts. This can be achieved via direct access to individual report show/delete pages or APIs.

Recommendations For Foreman versions 1.8.0 through 1.8.3, update to version 1.8.4 to resolve the issue. For Foreman versions 1.9.0 through 1.9.0, update to version 1.9.1 to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-5233

RHSA-2015:2622

Produtos afetados

Foreman

Referências · 5

• https://t.me/cvenotify/44180 · Publicação no Telegram
• http://projects.theforeman.org/issues/11579 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5233 · Nota de Segurança
• http://theforeman.org/security.html#CVE-2015-5233:reportsshow/destroynotrestrictedbyhostauthorization · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2015:2622 · Aviso do Fabricante