CVE-2016-7078mediumCWE-285

CVE-2016-7078

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 1.4%

exploitation probability

1.4%top 31% of all CVEs

observed exploitation

nono source reports it

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

Foreman · foreman

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078 https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905 https://projects.theforeman.org/issues/16982 https://seclists.org/oss-sec/2017/q1/470 https://theforeman.org/security.html#2016-7078 http://www.securityfocus.com/bid/96385