Theforeman Foreman vulnerabilities

CVE-2025-9572 [MEDIUM] CWE-863 CVE-2025-9572: n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

CVE-2023-4886 [MEDIUM] CWE-200 CVE-2023-4886: A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.

CVE-2023-0462 [HIGH] CWE-94 CVE-2023-0462: An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.

CVE-2021-3590 [HIGH] CWE-200 CVE-2021-3590: A flaw was found in Foreman project. A credential leak was identified which will expose Azure Comput A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVE-2020-10710 [MEDIUM] CWE-522 CVE-2020-10710: A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellit A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allows an attacker with sufficiently high privileges, such as root, to retrieve the Candlepin plaintext password.

CVE-2021-3584 [HIGH] CWE-78 CVE-2021-3584: A server side remote code execution vulnerability was found in Foreman project. A authenticated atta A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.

CVE-2021-3469 [MEDIUM] CWE-863 CVE-2021-3469: Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling fla Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorizatio

CVE-2021-3494 [MEDIUM] CWE-319 CVE-2021-3494: A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the f A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this fl

CVE-2014-8183 [HIGH] CWE-284 CVE-2014-8183: It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce acc It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.

CVE-2019-3893 [MEDIUM] CWE-732 CVE-2019-3893: In Foreman it was discovered that the delete compute resource operation, when executed from the Fore In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions b

CVE-2018-16861 [HIGH] CWE-79 CVE-2018-16861: A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users.

CVE-2018-14664 [MEDIUM] CWE-79 CVE-2018-14664: A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists d A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.

CVE-2016-7077 [MEDIUM] CWE-285 CVE-2016-7077: foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper do foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.

CVE-2016-7078 [MEDIUM] CWE-285 CVE-2016-7078: foreman before version 1.15.0 is vulnerable to an information leak through organizations and locatio foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editi

CVE-2016-8639 [MEDIUM] CWE-79 CVE-2016-8639: It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or locatio It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.

CVE-2016-8634 [MEDIUM] CWE-79 CVE-2016-8634: A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, i A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a us

CVE-2016-8613 [MEDIUM] CWE-79 CVE-2016-8613: A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS v

CVE-2017-7535 [MEDIUM] CWE-79 CVE-2017-7535: foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action.

CVE-2017-2672 [MEDIUM] CWE-312 CVE-2017-2672: A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to access those systems.

CVE-2016-9593 [MEDIUM] CWE-522 CVE-2016-9593: foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.