CVE-2015-1844 : Foreman before 1.7.5 allows remote authenticated users to bypass organization an

Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.

Published 2015-08-14 18:59:05

Updated 2018-08-13 21:47:52

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2015-1844

Theforeman » Foreman
Versions up to, including, (<=) 1.7.4
cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

https://access.redhat.com/errata/RHSA-2015:1591

RHSA-2015:1591 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
https://groups.google.com/forum/#!topic/foreman-announce/37KYWhIk4FY

foreman-announce - Google Groepen
https://github.com/theforeman/foreman/pull/2273

Fixes #9947 - restrict user taxonomies if none is set by ares · Pull Request #2273 · theforeman/foreman · GitHub
Patch
https://groups.google.com/forum/#!topic/foreman-users/qAGZh5n6n6M

Foreman users - Google Groepen
https://access.redhat.com/errata/RHSA-2015:1592

RHSA-2015:1592 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://projects.theforeman.org/issues/9947

Bug #9947: CVE-2015-1844 - GET /api/hosts doesn't respect organization/location membership - Foreman
Vendor Advisory

Jump to