CVE-2015-3155 — Improper Access Control in Foreman

CWE-284 — Improper Access Control5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
0.6%
top 31.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Theforeman Foreman
Timeline
PublishedAug 14
Latest updateMay 14

Description

Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-286g-52x6-9289: Foreman before 1↗2022-05-14
▶
CVEList
CVE-2015-3155: Foreman before 1↗2015-08-14
▶

📋Vendor Advisories

1
Red Hat
foreman: the _session_id cookie is issued without the Secure flag↗2015-04-27
▶

💬Community

1
Bugzilla
CVE-2015-3155 foreman: the _session_id cookie is issued without the Secure flag↗2015-04-28
▶
CVE-2015-3155 — Improper Access Control in Foreman | cvebase