CVE-2016-4475 — Improper Access Control in Foreman

CWE-254CWE-284 — Improper Access Control5 documents5 sources
Severity
8.8HIGHNVD
EPSS
0.2%
top 60.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Theforeman Foreman
Timeline
PublishedAug 19
Latest updateMay 14

Description

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶NVDtheforeman/foreman1.11.3+1

Patches

Patch: projects.theforeman.org ↗Patch: projects.theforeman.org ↗Patch: projects.theforeman.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-8887-4wpv-8chr: The (1) Organization and (2) Locations APIs and UIs in Foreman before 1↗2022-05-14
▶
CVEList
CVE-2016-4475: The (1) Organization and (2) Locations APIs and UIs in Foreman before 1↗2016-08-19
▶

📋Vendor Advisories

1
Red Hat
foreman: API and UI actions/URLs not limited to the orgs/locations assigned↗2016-06-02
▶

💬Community

1
Bugzilla
CVE-2016-4475 foreman: API and UI actions/URLs not limited to the orgs/locations assigned↗2016-06-03
▶
CVE-2016-4475 — Improper Access Control in Foreman | cvebase