GitHub Advisoryadvisory · RubyGems

GHSA-cpv6-pfq6-j2v7 katello Improper Privilege Management vulnerability

MEDIUM Published 2022-05-13 Modified 2023-01-27 Official page ↗
Aliases
CVE-2017-2662
Ecosystem
RubyGems
Packages
katello
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-269
Reviewed
2023-01-27

Affected packages

• RubyGems katello: < 3.17.0.rc1 → fixed in 3.17.0.rc1

Description

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.

Related

Alias · CVE (1)

  • CVE-2017-2662 A flaw was found in Foreman's katello plugin version 3.4.5. vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References