CVE-2024-3716
published 2024-06-05CVE-2024-3716: A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list…
PriorityP430medium6.2CVSS 3.1
AVLACLPRNUINSUCHINAN
EPSS
0.21%
10.6th percentile
A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | satellite | — | — |
CVSS provenance
nvdv3.16.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vg42-hcc7-h8cf: A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter
ghsa_unreviewed·2024-06-05
CVE-2024-3716 [MEDIUM] CWE-200 GHSA-vg42-hcc7-h8cf: A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter
A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password.
Red Hat
foreman-installer: Candlepin database password being leaked to local users via the process list
vendor_redhat·2024-06-05·CVSS 6.2
CVE-2024-3716 [MEDIUM] CWE-200 foreman-installer: Candlepin database password being leaked to local users via the process list
foreman-installer: Candlepin database password being leaked to local users via the process list
A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password.
A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password.
Package: foreman-installer (Red Hat Satellite 6) - Affected
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-06-05
Published