CVE-2020-10716

CWE-2855 documents5 sources
Severity
6.5MEDIUM
EPSS
0.2%
top 63.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Theforeman Foreman AnsibleRedhat SatelliteRedhat Satellite Capsule
Timeline
PublishedMay 27
Latest updateMay 24

Description

A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5rubygem-foreman_ansibletfm-rubygem-foreman_ansible 4.0.3.4

🔴Vulnerability Details

2
GHSA
GHSA-w5v4-7h7x-xfvq: A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view↗2022-05-24
▶
CVEList
CVE-2020-10716: A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view↗2021-05-27
▶

📋Vendor Advisories

1
Red Hat
rubygem-foreman_ansible: "User input" entry from Job Invocation may contain sensitive data↗2020-04-23
▶

💬Community

1
Bugzilla
CVE-2020-10716 rubygem-foreman_ansible: "User input" entry from Job Invocation may contain sensitive data↗2020-04-23
▶