PT-2023-30988 · Apache+1 · Apache Tomcat+1

Pedro Sampaio · Published 2023-10-03 · Updated 2025-03-26 · CVE-2023-4886

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions foreman (affected versions not specified)

Description A sensitive information exposure issue was found in foreman, where the contents of tomcat's server.xml file are world readable. This file contains passwords to candlepin's keystore and truststore.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2025-3716

CVE-2023-4886

RHSA-2023:7851

RHSA-2024:1061

Affected Products

Alt Linux

Apache Tomcat

References · 10

• https://access.redhat.com/errata/RHSA-2023:7851 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-4886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4886 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4886 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2230135 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1061 · Vendor Advisory
• https://t.me/cibsecurity/71505 · Telegram Post
• https://t.me/cvenotify/72739 · Telegram Post
• https://twitter.com/CVEnew/status/1709214826772508944 · Twitter Post
• https://t.me/cvenotify/59023 · Telegram Post