SB2016082002 - Information disclosure in Foreman Foreman
Published: August 20, 2016 Updated: July 18, 2020
Security Bulletin ID
SB2016082002
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Information disclosure (CVE-ID: CVE-2016-5390)
The vulnerability allows a remote authenticated user to gain access to sensitive information.
Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces.
Remediation
Install update from vendor's website.