PT-2018-7173 · Foreman · Foreman

Daniel Kimsey · Published 2018-06-21 · Updated 2019-10-09 · CVE-2017-2672

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.15

Description: A flaw in the logging of adding and registering images allows an attacker with access to the log file to view passwords for provisioned systems, potentially granting them access to those systems.

Recommendations: For versions prior to 1.15, update to version 1.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the log file to minimize the risk of exploitation.

Exploit

Fix

Improper Privilege Management

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-269

CWE-312

Related Identifiers

CVE-2017-2672

RHSA-2018:0336

Affected Products

Foreman

References · 6

• 🔥 https://projects.theforeman.org/issues/19169 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2672 · Exploit
• https://access.redhat.com/errata/RHSA-2018:0336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2672 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2672 · Vendor Advisory
• http://securityfocus.com/bid/97526 · Note