CVEvulnerability
CVE-2016-4451
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-08-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.0 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-254
Description
The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.
Affected configurations
• theforeman foreman (<= 1.11.2)
• theforeman foreman 1.12.0
Related
Weakness · not in database (1)
References
- http://projects.theforeman.org/issues/15182 Vendor Advisory
- http://projects.theforeman.org/projects/foreman/repository/revisions/1144040f444b4bf4aae81940a150b26b23b4623c Patch, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:0336 access.redhat.com
- https://theforeman.org/security.html#2016-4451 Vendor Advisory
- http://projects.theforeman.org/issues/15182 Vendor Advisory
- http://projects.theforeman.org/projects/foreman/repository/revisions/1144040f444b4bf4aae81940a150b26b23b4623c Patch, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:0336 access.redhat.com
- https://theforeman.org/security.html#2016-4451 Vendor Advisory