PT-2016-3676 · Foreman · Foreman

Daniel Lobato Garcia · Published 2016-04-11 · Updated 2023-02-13 · CVE-2015-5233

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Foreman versions 1.8.0 through 1.8.3 Foreman versions 1.9.0 through 1.9.0

Description The issue allows remote authenticated users with the view reports permission to read reports from arbitrary hosts or remote authenticated users with the destroy reports permission to delete reports from arbitrary hosts. This can be achieved via direct access to individual report show/delete pages or APIs.

Recommendations For Foreman versions 1.8.0 through 1.8.3, update to version 1.8.4 to resolve the issue. For Foreman versions 1.9.0 through 1.9.0, update to version 1.9.1 to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-5233

RHSA-2015:2622

Affected Products

Foreman

References · 5

• http://projects.theforeman.org/issues/11579 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5233 · Security Note
• http://theforeman.org/security.html#CVE-2015-5233:reportsshow/destroynotrestrictedbyhostauthorization · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2015:2622 · Vendor Advisory
• https://t.me/cvenotify/44180 · Telegram Post