GitHub Advisoryadvisory · RubyGems

GHSA-f2rp-4rv7-fc95 Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox

HIGH Published 2021-06-10 Modified 2023-01-24 Official page ↗
Aliases
CVE-2021-20259
Ecosystem
RubyGems
Packages
foreman_fog_proxmox
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2021-06-10

Affected packages

• RubyGems foreman_fog_proxmox: < 0.13.1 → fixed in 0.13.1

Description

A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Versions of foreman_fog_proxmox prior to 0.13.1 are affected.

Related

Alias · CVE (1)

  • CVE-2021-20259 A flaw was found in the Foreman project. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References