PT-2024-37910 · Foreman · Foreman

Sébastien Vecten · CVE-2024-6861 · Published 2024-11-06 · Updated 2024-11-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions foreman (affected versions not specified)

Description A disclosure of sensitive information flaw was found in foreman via the "GraphQL API". If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys, which could result in a compromise of the entire product's API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-6861

RHSA-2022:8506

Affected Products

Foreman

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-6861 · Security Note
• https://access.redhat.com/errata/RHSA-2022:8506 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1854345090715586755 · Twitter Post
• https://t.me/latest_high_impact_cve/1461 · Telegram Post
• https://t.me/cvedetector/10008 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2024-6861 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2317450 · Note
• https://twitter.com/CVEnew/status/1854181275935953102 · Twitter Post
• https://projects.theforeman.org/issues/34328 · Note
• https://docs.theforeman.org/3.3/Release_Notes/index-katello.html#_foreman_2 · Note