Vulnerability Details : CVE-2014-3691
Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.
Products affected by CVE-2014-3691
- cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*
- cpe:2.3:a:theforeman:foreman:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:theforeman:foreman:1.6.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-3691
0.62%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 76 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-3691
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2014-3691
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3691
-
https://groups.google.com/forum/#%21topic/foreman-announce/jXC5ixybjqo
Sign in - Google Accounts
-
http://projects.theforeman.org/issues/7822
Bug #7822: CVE-2014-3691 - Smart proxy doesn't perform verification of client SSL certificate on API requests - Smart Proxy - ForemanVendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2015-0287.html
RHSA-2015:0287 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2015-0288.html
RHSA-2015:0288 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://github.com/theforeman/smart-proxy/pull/217
fixes #7822 - forbid HTTPS requests with no client SSL certificate by domcleal · Pull Request #217 · theforeman/smart-proxy · GitHubPatch;Issue Tracking
Jump to