PT-2018-2975 · Red Hat · Foreman+1

Publicado 2018-10-11 · Atualizado 2019-10-09 · CVE-2018-14666

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Satellite 6 versions

Description An improper authorization flaw was found in the Smart Class feature of Foreman, allowing an attacker to change the configuration of any host registered in Red Hat Satellite, regardless of the organization the host belongs to. This issue is related to incorrect authorization in the implementation of the Smart Class feature in Red Hat Satellite and Foreman, which could enable a remote attacker to modify configuration files.

Recommendations For Red Hat Satellite 6 versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Incorrect Authorization

Enumeração de Fraquezas

CWE-285

CWE-863

Identificadores relacionados

BDU:2019-02945

CVE-2018-14666

Produtos afetados

Foreman

Red Hat Satellite

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-14666 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2018-14666 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14666 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14666 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-02945 · Nota de Segurança
• http://securityfocus.com/bid/106490 · Nota