PT-2018-4983

CVE-2016-7077

Published

2018-09-10

Updated

2019-10-09

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.14.0

Description The issue is related to an information leak in Foreman. It was discovered that the Foreman form helper does not properly authorize options for associated objects. As a result, an unauthorized user can view the names of such objects if their count is less than 6.

Recommendations For versions prior to 1.14.0, update to version 1.14.0 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-285: Improper Authorization

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers