CVE-2016-4451

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-4451
The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability : 1.6 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://projects.theforeman.org/issues/15182 Vendor Advisory
http://projects.theforeman.org/projects/foreman/repository/revisions/1144040f444b4bf4aae81940a150b26b23b4623c Patch Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0336
https://theforeman.org/security.html#2016-4451 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*
cpe:2.3:a:theforeman:foreman:1.12.0:*:*:*:*:*:*:*
History

12 Feb 2023, 23:21

Type Values Removed Values Added
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1339889', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1339889', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2016-4451', 'name': 'https://access.redhat.com/security/cve/CVE-2016-4451', 'tags': [], 'refsource': 'MISC'}
Summary It was found that Satellite 6 did not properly enforce access controls on certain resources. An attacker, with access to the API and knowledge of the ID name, can potentially access other resources in other organizations. The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.

02 Feb 2023, 16:17

Type Values Removed Values Added
Summary The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization. It was found that Satellite 6 did not properly enforce access controls on certain resources. An attacker, with access to the API and knowledge of the ID name, can potentially access other resources in other organizations.
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1339889 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2016-4451 -
Information

Published : 2016-08-19 21:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-4451

Mitre link : CVE-2016-4451

CVE.ORG link : CVE-2016-4451

JSON object : View

Products Affected

theforeman

  • foreman
CWE
CWE-254

7PK - Security Features