PT-2016-5968 · Foreman · Foreman

Ivan Necas · Publicado 2016-08-19 · Atualizado 2023-02-12 · CVE-2016-4475

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.11.4 Foreman versions 1.12.x prior to 1.12.0-RC3

Description The issue allows remote authenticated users to bypass organization and location restrictions. This enables users to read, edit, or delete arbitrary organizations or locations. The exact vectors used for exploitation are not specified.

Recommendations For Foreman versions prior to 1.11.4, update to version 1.11.4 or later. For Foreman versions 1.12.x prior to 1.12.0-RC3, update to version 1.12.0-RC3 or later.

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

CVE-2016-4475

Produtos afetados

Foreman

Referências · 7

• https://theforeman.org/security.html#2016-4475 · Aviso do Fabricante
• http://securityfocus.com/bid/92125 · Nota
• https://access.redhat.com/errata/RHBA-2016:1615 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-4475 · Nota de Segurança
• http://projects.theforeman.org/projects/foreman/repository/revisions/a30ab44ed6f140f1791afc51a1e448afc2ff28f9 · Aviso do Fabricante
• http://projects.theforeman.org/issues/15268 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-4475 · Aviso do Fabricante