CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3469
https://notcve.org/view.php?id=CVE-2021-3469
Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly. Foreman versiones anteriores a 2.3.4 y versiones anteriores a 2.4.0, están afectadas por un fallo en el manejo de la autorización. Un atacante autenticado puede hacerse pasar por el foreman-proxy si el producto permite que la autoridad de certificados (CA) de Puppet firme peticiones de certificados que tengan nombres alternativos de sujeto (SAN). • https://bugzilla.redhat.com/show_bug.cgi?id=1943630 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3494 – foreman: possible man-in-the-middle in smart_proxy realm_freeipa
https://notcve.org/view.php?id=CVE-2021-3494
A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0. Un proxy inteligente que proporciona una API restful a varios subsistemas del Foreman está afectado por un fallo que puede causar un ataque de tipo Man-in-the-Middle. • https://bugzilla.redhat.com/show_bug.cgi?id=1948005 https://access.redhat.com/security/cve/CVE-2021-3494 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3893 – foreman: Recover of plaintext password or token for the compute resources
https://notcve.org/view.php?id=CVE-2019-3893
In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable. En Foreman se descubrió que la operación de eliminar recursos de cálculo, cuando se ejecuta desde la API de Foreman, conduce a la revelación de la contraseña de texto plano o token para el recurso de cálculo afectado. Un usuario malicioso con el permiso "delete_compute_resource" puede utilizar este fallo para tomar el control de los recursos de cálculo gestionados por Foreman. • http://www.openwall.com/lists/oss-security/2019/04/14/2 http://www.securityfocus.com/bid/107846 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3893 https://github.com/theforeman/foreman/pull/6621 https://projects.theforeman.org/issues/26450 https://access.redhat.com/security/cve/CVE-2019-3893 https://bugzilla.redhat.com/show_bug.cgi?id=1696400 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.6EPSS: 0%CPEs: 4EXPL: 0CVE-2018-16861 – foreman: stored XSS in success notification after entity creation
https://notcve.org/view.php?id=CVE-2018-16861
A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable. Se ha encontrado un error Cross-Site Scripting (XSS) en el componente "satellite" de Foreman. Un atacante con privilegios para crear entradas mediante los menús Hosts, Monitor, Infrastructure o Administer puede ejecutar ataques Cross-Site Scripting (XSS) contra otros usuarios, lo que podría conducir a la ejecución de código malicioso y a la extracción del token anti-CSRF de usuarios con mayores privilegios. • https://access.redhat.com/errata/RHSA-2019:1222 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16861 https://access.redhat.com/security/cve/CVE-2018-16861 https://bugzilla.redhat.com/show_bug.cgi?id=1645201 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2018-14664 – foreman: Persisted XSS on all pages that use breadcrumbs
https://notcve.org/view.php?id=CVE-2018-14664
A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side. Se ha descubierto un problema desde la versión 1.18 de foreman. Existe una vulnerabilidad Cross-Site Scripting (XSS) persistente debido a código HTML escapado incorrectamente en la barra de miga de pan. • http://www.securityfocus.com/bid/106553 https://access.redhat.com/errata/RHSA-2019:1222 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14664 https://projects.theforeman.org/issues/25169 https://access.redhat.com/security/cve/CVE-2018-14664 https://bugzilla.redhat.com/show_bug.cgi?id=1638130 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •