CVEvulnerability
CVE-2016-7078
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-09-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 4.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.0 ([email protected])
- 4.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-200, CWE-285
Description
foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.
Affected configurations
• theforeman foreman 1.15.0
Related
References
- http://www.securityfocus.com/bid/96385 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078 Issue Tracking, Third Party Advisory
- https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905 Third Party Advisory
- https://projects.theforeman.org/issues/16982 Vendor Advisory
- https://seclists.org/oss-sec/2017/q1/470 Mailing List, Third Party Advisory
- https://theforeman.org/security.html#2016-7078 Vendor Advisory
- http://www.securityfocus.com/bid/96385 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078 Issue Tracking, Third Party Advisory
- https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905 Third Party Advisory
- https://projects.theforeman.org/issues/16982 Vendor Advisory
- https://seclists.org/oss-sec/2017/q1/470 Mailing List, Third Party Advisory
- https://theforeman.org/security.html#2016-7078 Vendor Advisory