PT-2017-6817 · Foreman · Foreman

Dominic Cleal + 1 · Published 2017-07-14 · Updated 2023-02-13 · CVE-2015-5152

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Foreman versions 1.1 through 1.9.0-RC1

Description The issue allows remote attackers to obtain user credentials via a man-in-the-middle attack because HTTP requests are not redirected to HTTPS when the require ssl setting is set to true.

Recommendations For versions 1.1 through 1.9.0-RC1, ensure the require ssl setting is properly configured and consider implementing additional security measures to enforce HTTPS connections, such as configuring the server to redirect all HTTP requests to HTTPS.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-5152

Affected Products

Foreman

References · 3

• http://projects.theforeman.org/issues/11119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5152 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1243571 · Note