CVE-2015-3155

Foreman vulnerable: Foreman before 1.8.1 does not set the secure flag on the _session_id cookie in HTTPS sessions, enabling cookie capture over HTTP. Impact is partial confidentiality loss. Remediation: update to Foreman 1.8.1 or later (fixes the secure flag handling).

CVE-2015-1844

CVE-2015-1844 corresponds to a Foreman/Satellite API authorization flaw: remote authenticated users could bypass organization/location restrictions via the REST API. Connected advisories (RHSA-2015:1591/1592) indicate affected Foreman components and that remediation is provided through Red Hat Sa...

PT-2015-6081 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.8.1 Description: The issue makes it easier for remote attackers to capture the session id cookie by intercepting its transmission within an http session, as the secure flag is not set for this cookie in an https...

PT-2015-6112 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.9.0 Description: The issue allows remote authenticated users with the edit users permission to edit administrator users and change their passwords. An attacker with the edit users permission could use this flaw to...

rhn_satellite_6: cross-site request forgery (CSRF) can force logout

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

foreman: cross-site scripting (XSS) flaw in template preview screen

A cross-site scripting XSS flaw was found in Foreman's template preview screen. A remote attacker could use this flaw to perform cross-site scripting attacks by tricking a user into viewing a malicious template. Note that templates are commonly shared among users...

foreman: edit_users permission allows changing of admin passwords

It was discovered that in Foreman the editusers permissions for example, granted to the Manager role allowed the user to edit admin user passwords. An attacker with the editusers permissions could use this flaw to access an admin user account, leading to an escalation of privileges...

foreman: lack of SSL certificate validation when performing LDAPS authentication

It was found that when making an SSL connection to an LDAP authentication source in Foreman, the remote server certificate was accepted without any verification against known certificate authorities, potentially making TLS connections vulnerable to man-in-the-middle attacks...

foreman: the _session_id cookie is issued without the Secure flag

It was found that Foreman did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...

foreman: cross-site scripting (XSS) flaw in template preview screen

A cross-site scripting XSS flaw was found in Foreman's template preview screen. A remote attacker could use this flaw to perform cross-site scripting attacks by tricking a user into viewing a malicious template. Note that templates are commonly shared among users...

foreman: the _session_id cookie is issued without the Secure flag

It was found that Foreman did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...

foreman: edit_users permission allows changing of admin passwords

It was discovered that in Foreman the editusers permissions for example, granted to the Manager role allowed the user to edit admin user passwords. An attacker with the editusers permissions could use this flaw to access an admin user account, leading to an escalation of privileges...

foreman: lack of SSL certificate validation when performing LDAPS authentication

It was found that when making an SSL connection to an LDAP authentication source in Foreman, the remote server certificate was accepted without any verification against known certificate authorities, potentially making TLS connections vulnerable to man-in-the-middle attacks...

CVE-2014-3653

Cross-site scripting XSS vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template...

Cross site scripting

Cross-site scripting XSS vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template...

CVE-2014-3653

Cross-site scripting XSS vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template...

CVE-2014-3653

CVE-2014-3653 is an XSS vulnerability in Foreman’s template preview function prior to 1.6.1, allowing a remote attacker to inject arbitrary script/HTML via a crafted provisioning template. Impact is cross-site scripting in the affected web UI; remediation is to upgrade to Foreman 1.6.1 or later a...

Authentication flaw

Smart Proxy aka Smart-Proxy and foreman-proxy in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate...

CVE-2014-3691

Foreman/foreman-proxy is affected by CVE-2014-3691 due to failure to validate SSL certificates in SSL-enabled mode, allowing remote attackers to bypass authentication and issue arbitrary API requests without a certificate. Affected versions: Foreman prior to 1.5.4 and foreman-proxy in Foreman 1.6...

CVE-2014-3691

Smart Proxy aka Smart-Proxy and foreman-proxy in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate...