PT-2018-7173 · Foreman · Foreman

Daniel Kimsey · Publicado 2018-06-21 · Atualizado 2019-10-09 · CVE-2017-2672

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.15

Description: A flaw in the logging of adding and registering images allows an attacker with access to the log file to view passwords for provisioned systems, potentially granting them access to those systems.

Recommendations: For versions prior to 1.15, update to version 1.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the log file to minimize the risk of exploitation.

Exploit

Correção

Improper Privilege Management

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-269

CWE-312

Identificadores relacionados

CVE-2017-2672

RHSA-2018:0336

Produtos afetados

Foreman

Referências · 6

• 🔥 https://projects.theforeman.org/issues/19169 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2672 · Exploit
• https://access.redhat.com/errata/RHSA-2018:0336 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2672 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-2672 · Aviso do Fabricante
• http://securityfocus.com/bid/97526 · Nota