PT-2016-5968 · Foreman · Foreman

Ivan Necas · Published 2016-08-19 · Updated 2023-02-12 · CVE-2016-4475

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.11.4 Foreman versions 1.12.x prior to 1.12.0-RC3

Description The issue allows remote authenticated users to bypass organization and location restrictions. This enables users to read, edit, or delete arbitrary organizations or locations. The exact vectors used for exploitation are not specified.

Recommendations For Foreman versions prior to 1.11.4, update to version 1.11.4 or later. For Foreman versions 1.12.x prior to 1.12.0-RC3, update to version 1.12.0-RC3 or later.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2016-4475

Affected Products

Foreman

References · 7

• https://theforeman.org/security.html#2016-4475 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2016:1615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4475 · Security Note
• http://projects.theforeman.org/projects/foreman/repository/revisions/a30ab44ed6f140f1791afc51a1e448afc2ff28f9 · Vendor Advisory
• http://projects.theforeman.org/issues/15268 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4475 · Vendor Advisory
• http://securityfocus.com/bid/92125 · Note