PT-2018-4983 · Foreman · Foreman

Jitendra Yejare · Published 2018-09-10 · Updated 2019-10-09 · CVE-2016-7077

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.14.0

Description The issue is related to an information leak in Foreman. It was discovered that the Foreman form helper does not properly authorize options for associated objects. As a result, an unauthorized user can view the names of such objects if their count is less than 6.

Recommendations For versions prior to 1.14.0, update to version 1.14.0 or later to resolve the issue.

Exploit

Fix

Improper Authorization

Information Disclosure

Weakness Enumeration

CWE-285

CWE-200

Related Identifiers

CVE-2016-7077

RHSA-2018:0336

Affected Products

Foreman

References · 6

• 🔥 https://projects.theforeman.org/issues/16971 · Exploit
• https://theforeman.org/security.html#2016-7077 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7077 · Security Note
• http://securityfocus.com/bid/94230 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7077 · Note