PT-2019-11615 · Foreman · Foreman-Tasks

Adam Ruzicka · Published 2019-07-31 · Updated 2020-09-30 · CVE-2019-10198

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: foreman-tasks versions prior to 0.15.7

Description: An authentication bypass issue was found, allowing an unauthenticated user to view task details through the web UI or API if they can discover or guess the UUID of the task.

Recommendations: For versions prior to 0.15.7, update to version 0.15.7 or later to resolve the issue.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

CWE-592

Related Identifiers

CVE-2019-10198

RHSA-2019:3172

Affected Products

Foreman-Tasks

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-10198 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10198 · Patch
• https://access.redhat.com/errata/RHSA-2019:3172 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10198 · Vendor Advisory
• https://projects.theforeman.org/issues/27275 · Note