CVE-2016-4995

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-4995
Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information via a URL with a hostname.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

3.5 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:N/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://projects.theforeman.org/issues/15490 Patch Vendor Advisory
http://projects.theforeman.org/projects/foreman/repository/revisions/c3c186de12be15e55d9582e54659f765304a1073 Patch Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0336 Third Party Advisory
https://theforeman.org/security.html#2016-4995 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*
cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*
History

12 Feb 2023, 23:22

Type Values Removed Values Added
Summary A flaw was found in foreman's handling of template previews. An attacker with permissions to preview host templates can access the template preview for any host if they are able to guess the host name, disclosing potentially sensitive information. Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information via a URL with a hostname.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2016-4995', 'name': 'https://access.redhat.com/security/cve/CVE-2016-4995', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1348939', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1348939', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 21:17

Type Values Removed Values Added
Summary Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information via a URL with a hostname. A flaw was found in foreman's handling of template previews. An attacker with permissions to preview host templates can access the template preview for any host if they are able to guess the host name, disclosing potentially sensitive information.
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2016-4995 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1348939 -
Information

Published : 2016-08-19 21:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-4995

Mitre link : CVE-2016-4995

CVE.ORG link : CVE-2016-4995

JSON object : View

Products Affected

theforeman

  • foreman
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor