CVE-2019-3893
published 2019-04-09CVE-2019-3893: In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password…
PriorityP428medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
EPSS
1.86%
76.6th percentile
In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | satellite | — | — |
| the_foreman_project | foreman | — | — |
| the_foreman_project | foreman | — | — |
| the_foreman_project | foreman | — | — |
| theforeman | foreman | >= 1.20.0 < 1.20.3 | 1.20.3 |
| theforeman | foreman | >= 1.21.0 < 1.21.1 | 1.21.1 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv3.04.9MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
foreman: Recover of plaintext password or token for the compute resources
vendor_redhat·2019-04-09·CVSS 4.9
CVE-2019-3893 [MEDIUM] CWE-732 foreman: Recover of plaintext password or token for the compute resources
foreman: Recover of plaintext password or token for the compute resources
In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.
It was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by for
GHSA
GHSA-xfjc-qf4h-hwgq: In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext
ghsa_unreviewed·2022-05-13
CVE-2019-3893 [MEDIUM] CWE-732 GHSA-xfjc-qf4h-hwgq: In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext
In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2019/04/14/2http://www.securityfocus.com/bid/107846https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3893https://github.com/theforeman/foreman/pull/6621https://projects.theforeman.org/issues/26450http://www.openwall.com/lists/oss-security/2019/04/14/2http://www.securityfocus.com/bid/107846https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3893https://github.com/theforeman/foreman/pull/6621https://projects.theforeman.org/issues/26450
2019-04-09
Published