CVE-2019-3893

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.20.3 Foreman versions prior to 1.21.1 Foreman versions prior to 1.22.0

Description The delete compute resource operation in Foreman, when executed from the Foreman API, can lead to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the delete compute resource permission can exploit this flaw to take control over compute resources managed by Foreman.

Recommendations For versions prior to 1.20.3, update to version 1.20.3 or later. For versions prior to 1.21.1, update to version 1.21.1 or later. For versions prior to 1.22.0, update to version 1.22.0 or later.