PT-2018-2975 · Red Hat · Foreman+1

Published 2018-10-11 · Updated 2019-10-09 · CVE-2018-14666

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Satellite 6 versions

Description An improper authorization flaw was found in the Smart Class feature of Foreman, allowing an attacker to change the configuration of any host registered in Red Hat Satellite, regardless of the organization the host belongs to. This issue is related to incorrect authorization in the implementation of the Smart Class feature in Red Hat Satellite and Foreman, which could enable a remote attacker to modify configuration files.

Recommendations For Red Hat Satellite 6 versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

Related Identifiers

BDU:2019-02945

CVE-2018-14666

Affected Products

Foreman

Red Hat Satellite

References · 6

• https://osv.dev/vulnerability/CVE-2018-14666 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14666 · Security Note
• https://bdu.fstec.ru/vul/2019-02945 · Security Note
• https://access.redhat.com/security/cve/cve-2018-14666 · Note
• http://securityfocus.com/bid/106490 · Note