CVE-2016-7077
foreman: Foreman information leak through unauthorized multiple_checkboxes helper
Severity Score
4.3
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.
Foreman en versiones anteriores a la 1.14.0 es vulnerable a una fuga de información. Se ha detectado que el ayudante de formularios de Foreman no autoriza las opciones para objetos asociados. Un usuario no autorizado puede ver los nombres de tales objetos si su contador está a menos de 6
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-08-23 CVE Reserved
- 2018-09-10 CVE Published
- 2024-06-25 EPSS Updated
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-285: Improper Authorization
CAPEC
References (6)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/94230 | Third Party Advisory | |
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7077 | Issue Tracking |
URL | Date | SRC |
---|---|---|
https://projects.theforeman.org/issues/16971 | 2024-08-06 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://theforeman.org/security.html#2016-7077 | 2023-11-07 | |
https://access.redhat.com/security/cve/CVE-2016-7077 | 2018-02-21 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1385777 | 2018-02-21 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Theforeman Search vendor "Theforeman" | Foreman Search vendor "Theforeman" for product "Foreman" | < 1.14.0 Search vendor "Theforeman" for product "Foreman" and version " < 1.14.0" | - |
Affected
|