PT-2014-3527 · Foreman · Foreman

Published 2014-05-08 · Updated 2023-02-13 · CVE-2014-0192

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Foreman versions 1.4.0 through 1.4.x

Description The issue allows remote attackers to obtain sensitive information via the hostname parameter. This is related to spoofing, where access to provisioning template previews is not properly restricted.

Recommendations For Foreman versions 1.4.0 through 1.4.x, update to version 1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the provisioning template previews to minimize the risk of exploitation. Avoid using the hostname parameter in sensitive operations until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-0192

Affected Products

Foreman

References · 4

• 🔥 http://projects.theforeman.org/issues/5436 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-0192 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1092354 · Patch
• http://theforeman.org/security.html · Vendor Advisory