CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Theforeman » Foreman : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-3893 200 +Info 2019-04-09 2019-04-15
4.0
None Remote Low Single system Partial None None
In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.
2 CVE-2018-16861 79 Exec Code +Priv XSS CSRF 2018-12-07 2018-12-28
3.5
None Remote Medium Single system None Partial None
A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.
3 CVE-2018-14664 79 Exec Code XSS 2018-10-12 2019-01-15
3.5
None Remote Medium Single system None Partial None
A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.
4 CVE-2018-14643 287 Exec Code Bypass 2018-09-21 2018-12-13
10.0
None Remote Low Not required Complete Complete Complete
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
5 CVE-2018-1097 200 +Info 2018-04-04 2018-10-17
4.0
None Remote Low Single system Partial None None
A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.
6 CVE-2018-1096 89 Sql 2018-04-05 2018-10-17
4.0
None Remote Low Single system Partial None None
An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.
7 CVE-2017-15100 79 XSS 2017-11-27 2018-10-17
4.3
None Remote Medium Not required None Partial None
An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.
8 CVE-2017-7535 79 XSS 2018-07-26 2018-09-20
4.3
None Remote Medium Not required None Partial None
foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action.
9 CVE-2017-7505 264 2017-05-26 2017-06-09
6.5
None Remote Low Single system Partial Partial Partial
Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords.
10 CVE-2017-2672 284 2018-06-21 2018-08-13
4.0
None Remote Low Single system Partial None None
A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to access those systems.
11 CVE-2016-9593 255 2018-04-16 2018-05-23
4.0
None Remote Low Single system Partial None None
foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.
12 CVE-2016-8639 79 XSS 2018-08-01 2018-10-01
3.5
None Remote Medium Single system None Partial None
It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.
13 CVE-2016-8634 79 XSS 2018-08-01 2018-10-04
3.5
None Remote Medium Single system None Partial None
A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.
14 CVE-2016-8613 79 Exec Code XSS 2018-07-31 2018-10-04
4.3
None Remote Medium Not required None Partial None
A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.
15 CVE-2016-7078 200 +Info 2018-09-10 2018-11-02
4.0
None Remote Low Single system Partial None None
foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.
16 CVE-2016-7077 200 +Info 2018-09-10 2018-11-02
4.0
None Remote Low Single system Partial None None
foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.
17 CVE-2016-6320 79 XSS 2016-08-19 2018-01-04
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in app/assets/javascripts/host_edit_interfaces.js in Foreman before 1.12.2 allows remote authenticated users to inject arbitrary web script or HTML via the network interface device identifier in the host interface form.
18 CVE-2016-6319 79 XSS 2016-08-19 2018-02-22
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via the label parameter.
19 CVE-2016-5390 200 +Info 2016-08-19 2016-08-22
2.1
None Remote High Single system Partial None None
Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces.
20 CVE-2016-4995 200 +Info 2016-08-19 2018-02-22
3.5
None Remote Medium Single system Partial None None
Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information via a URL with a hostname.
21 CVE-2016-4475 254 Bypass 2016-08-19 2018-01-04
6.5
None Remote Low Single system Partial Partial Partial
The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.
22 CVE-2016-4451 254 Bypass 2016-08-19 2018-02-22
6.0
None Remote Medium Single system Partial Partial Partial
The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.
23 CVE-2016-3728 284 Exec Code 2016-05-20 2018-01-04
6.8
None Remote Medium Not required Partial Partial Partial
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/.
24 CVE-2016-2100 284 2016-05-20 2018-01-04
6.5
None Remote Low Single system Partial Partial Partial
Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission.
25 CVE-2015-7518 79 XSS 2015-12-17 2016-12-02
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit forms.
26 CVE-2015-5282 79 XSS 2017-09-25 2017-09-29
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
27 CVE-2015-5246 254 2017-10-06 2017-11-01
6.8
None Remote Medium Not required Partial Partial Partial
The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.
28 CVE-2015-5233 264 2016-04-11 2016-04-20
6.0
None Remote Medium Single system Partial Partial Partial
Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs.
29 CVE-2015-5152 200 +Info 2017-07-17 2017-07-27
4.3
None Remote Medium Not required Partial None None
Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.
30 CVE-2015-3235 264 2015-08-14 2015-08-18
6.0
None Remote Medium Single system Partial Partial Partial
Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors.
31 CVE-2015-3155 284 2015-08-14 2018-08-13
5.0
None Remote Low Not required Partial None None
Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
32 CVE-2015-1844 264 Bypass 2015-08-14 2018-08-13
4.0
None Remote Low Single system Partial None None
Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.
33 CVE-2015-1816 310 2015-08-14 2018-08-13
5.0
None Remote Low Not required None Partial None
Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.
34 CVE-2014-4507 22 Dir. Trav. 2014-06-20 2014-06-23
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the dst parameter to tftp/fetch_boot_file.
35 CVE-2014-3691 310 Bypass 2015-03-09 2018-08-13
7.5
None Remote Low Not required Partial Partial Partial
Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.
36 CVE-2014-3653 79 XSS 2015-07-06 2015-07-08
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.
37 CVE-2014-3531 79 XSS 2017-10-18 2017-10-27
3.5
None Remote Medium Single system None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1) name or (2) description.
38 CVE-2014-3492 79 XSS 2014-07-01 2014-07-02
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter (1) name or (2) value related to the host.
39 CVE-2014-3491 79 XSS 2014-07-01 2014-07-02
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes.
40 CVE-2014-0208 79 XSS 2017-10-16 2017-11-01
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted key name.
41 CVE-2014-0192 264 +Info 2014-05-08 2014-05-08
5.0
None Remote Low Not required Partial None None
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."
42 CVE-2014-0090 287 2014-05-08 2014-05-09
6.8
None Remote Medium Not required Partial Partial Partial
Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie.
43 CVE-2014-0089 79 XSS 2014-03-27 2014-03-27
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.
44 CVE-2014-0007 Exec Code 2014-06-20 2014-06-23
7.5
None Remote Low Not required Partial Partial Partial
The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.
45 CVE-2013-4386 89 Exec Code Sql 2013-11-20 2018-08-13
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup parameter.
46 CVE-2013-4182 264 2013-09-16 2013-09-17
7.5
None Remote Low Not required Partial Partial Partial
app/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request.
47 CVE-2013-4180 20 DoS 2013-09-16 2013-09-17
5.0
None Remote Low Not required None None Partial
The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol.
48 CVE-2013-2121 94 1 Exec Code 2013-07-31 2018-08-13
6.0
None Remote Medium Single system Partial Partial Partial
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.
49 CVE-2013-2113 264 +Priv 2013-07-31 2018-08-13
6.0
User Remote Medium Single system Partial Partial Partial
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
50 CVE-2013-0210 94 Exec Code 2014-05-08 2014-05-08
7.5
None Remote Low Not required Partial Partial Partial
The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.
Total number of vulnerabilities : 56   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.