CVE-2018-1097
published 2018-04-04CVE-2018-1097: A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and…
PriorityP344high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
1.80%
75.7th percentile
A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| foreman_project | foreman | — | — |
| redhat | satellite | — | — |
| theforeman | foreman | < 1.6.1 | 1.6.1 |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fqv6-g44j-5jx7: A flaw was found in foreman before 1
ghsa_unreviewed·2022-05-13
CVE-2018-1097 [HIGH] CWE-200 GHSA-fqv6-g44j-5jx7: A flaw was found in foreman before 1
A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.
Red Hat
foreman: Ovirt admin password exposed by foreman API
vendor_redhat·2018-02-10·CVSS 8.8
CVE-2018-1097 [HIGH] CWE-200 foreman: Ovirt admin password exposed by foreman API
foreman: Ovirt admin password exposed by foreman API
A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.
Statement: This issue affects the versions of foreman as shipped with Red Hat Enterprise Satellite 6. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: foreman (Red Hat Ceph Storage 1.3) - Not affected
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2018:2927https://bugzilla.redhat.com/show_bug.cgi?id=1561723https://github.com/theforeman/foreman/pull/5369https://projects.theforeman.org/issues/22546https://access.redhat.com/errata/RHSA-2018:2927https://bugzilla.redhat.com/show_bug.cgi?id=1561723https://github.com/theforeman/foreman/pull/5369https://projects.theforeman.org/issues/22546
2018-04-04
Published