PT-2019-16758 · Foreman+1 · Foreman+1

Tomer Brisker · Published 2019-04-09 · Updated 2022-12-01 · CVE-2019-3893

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.20.3 Foreman versions prior to 1.21.1 Foreman versions prior to 1.22.0

Description The delete compute resource operation in Foreman, when executed from the Foreman API, can lead to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the delete compute resource permission can exploit this flaw to take control over compute resources managed by Foreman.

Recommendations For versions prior to 1.20.3, update to version 1.20.3 or later. For versions prior to 1.21.1, update to version 1.21.1 or later. For versions prior to 1.22.0, update to version 1.22.0 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALT-PU-2019-2801

ALT-PU-2020-2200

CVE-2019-3893

RHSA-2019:3172

Affected Products

Alt Linux

Foreman

References · 9

• https://projects.theforeman.org/issues/26450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3893 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3893 · Vendor Advisory
• https://github.com/theforeman/foreman/pull/6621 · Note
• http://securityfocus.com/bid/107846 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3893 · Note
• https://t.me/cvenotify/38834 · Telegram Post
• http://openwall.com/lists/oss-security/2019/04/14/2 · Note
• https://t.me/cvenotify/6599 · Telegram Post