CVE-2024-6861highCWE-200

CVE-2024-6861: fallo de gravedad alta en foreman

Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat Satellite+ Monitorear foreman

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.7%
A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
foremanRed Hat · Red Hat Satellite 6Red Hat · Red Hat Satellite 6.12 for RHEL 8
CVEs relacionadas — foreman

En el mismo producto, de las más peligrosas a las menos.

CVE-2013-2056HIGHRed hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypassEPSS 2.6%CVE-2022-3874HIGHOs command injection via ct_command and fcct_commandEPSS 2.2%CVE-2026-1961HIGHForman: foreman: remote code execution via command injection in websocket proxyEPSS 1.9%CVE-2026-12405HIGHRubygem-foreman_remote_execution: command injection in job invocations via effective_user parameterEPSS 1.6%CVE-2023-0118CRITICALForeman: arbitrary code execution through templatesEPSS 1.4%CVE-2011-4346MEDIUMSatellite: xss in custom system information key handlingEPSS 1.2%