PT-2023-30988 · Apache+1 · Apache Tomcat+1

Pedro Sampaio · Publicado 2023-10-03 · Atualizado 2025-03-26 · CVE-2023-4886

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions foreman (affected versions not specified)

Description A sensitive information exposure issue was found in foreman, where the contents of tomcat's server.xml file are world readable. This file contains passwords to candlepin's keystore and truststore.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2025-3716

CVE-2023-4886

RHSA-2023:7851

RHSA-2024:1061

Produtos afetados

Alt Linux

Apache Tomcat

Referências · 10

• https://t.me/cibsecurity/71505 · Publicação no Telegram
• https://access.redhat.com/errata/RHSA-2023:7851 · Aviso do Fabricante
• https://t.me/cvenotify/72739 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1709214826772508944 · Publicação no Twitter
• https://access.redhat.com/security/cve/CVE-2023-4886 · Aviso do Fabricante
• https://t.me/cvenotify/59023 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-4886 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-4886 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=2230135 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2024:1061 · Aviso do Fabricante