PT-2017-6817 · Foreman · Foreman

Dominic Cleal + 1 · Publicado 2017-07-14 · Atualizado 2023-02-13 · CVE-2015-5152

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Foreman versions 1.1 through 1.9.0-RC1

Description The issue allows remote attackers to obtain user credentials via a man-in-the-middle attack because HTTP requests are not redirected to HTTPS when the require ssl setting is set to true.

Recommendations For versions 1.1 through 1.9.0-RC1, ensure the require ssl setting is properly configured and consider implementing additional security measures to enforce HTTPS connections, such as configuring the server to redirect all HTTP requests to HTTPS.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-5152

Produtos afetados

Foreman

Referências · 3

• http://projects.theforeman.org/issues/11119 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5152 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1243571 · Nota