Main Vulnerability Database Vulnerabilities #VU10749

Information disclosure in Foreman - CVE-2016-4995

Published: February 27, 2018

Vulnerability identifier: #VU10749

CSH Severity: Low

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-4995

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to improper restriction of access to preview provisioning templates. A remote attacker with permissions to preview host templates can access the template preview for any host if they are able to guess the host name, and access potentially sensitive information.

Affected software

Foreman
Red Hat Satellite

How to mitigate CVE-2016-4995

Update to versions 1.11.4 or 1.12.1.

External References

https://theforeman.org/security.html#2016-4995

Related Security Bulletins