CVE-2023-4886

CWE-200 — Information Exposure5 documents5 sources
Severity
4.4MEDIUM
EPSS
0.1%
top 73.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Theforeman ForemanRedhat Satellite
Timeline
PublishedOct 3

Description

A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages2 packages

▶NVDtheforeman/foreman< 3.8.0

🔴Vulnerability Details

2
CVEList
Foreman: world readable file containing secrets↗2023-10-03
▶
GHSA
GHSA-r2mj-49jv-4jq7: A sensitive information exposure vulnerability was found in foreman↗2023-10-03
▶

📋Vendor Advisories

1
Red Hat
foreman: World readable file containing secrets↗2023-10-03
▶