Information disclosure in Foreman - CVE-2016-7077
Published: September 10, 2018 / Updated: August 8, 2020
Vulnerability identifier: #VU36709
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-7077
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to gain access to sensitive information.
foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.
Affected software
Foreman
How to mitigate CVE-2016-7077
Install update from vendor's website.
Foreman - update to 1.14.0