Information Disclosure

Red Hat Satellite is vulnerable to information disclosure. This exists in discovery-debug in foreman. Local users with access to the system journal could view the root password associated with that system...

Information Disclosure

Foreman is vulnerable to information disclosure vulnerability. The vulnerability exists in foreman's handling of template previews. Remote authenticated users with permission could view some hosts to obtain sensitive host configuration information via a URL with a hostname...

Security Bypass

Red Hat Satellite is vulnerable to security bypass vulnerability. This is because the foreman in Satellite 6 does not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...

foreman: stored XSS in success notification after entity creation

A cross-site scripting XSS flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and...

foreman: Persisted XSS on all pages that use breadcrumbs

A cross-site scripting XSS flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and...

RHEL 7 : Satellite 6.5 Release (Moderate) (RHSA-2019:1222)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1222 advisory. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring...

Foreman < 1.20.3 and 1.21.0 Information Disclosure Vulnerability

Foreman is prone to an authenticated information dislosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Privilege Escalation

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning and configuration management of predefined standard operating...

Man-In-The-Middle (MitM)

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning and configuration management of predefined standard operating...

Cross-Site Scripting (XSS)

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning and configuration management of predefined standard operating...

Arbitrary Code Execution

The Foreman is vulnerable to arbitrary code execution. Due to a flaw found in the create method of the Foreman Bookmarks controller. any user who can create a bookmark can execute malicious code with the privileges of the user running Foreman, giving them control of the system running Foreman and...

CVE-2019-3893

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control...

CVE-2019-3893

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control...

Design/Logic Flaw

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control...

CVE-2019-3893

CVE-2019-3893 affects Foreman: the delete_compute_resource operation via the Foreman API can disclose plaintext passwords/tokens for the affected compute resource. Vulnerable are Foreman versions prior to 1.20.3, 1.21.1, and 1.22.0. A malicious user with the delete_compute_resource permission can...

CVE-2019-3893

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control...

CVE-2019-3893

It was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control over compu...

PT-2019-16758 · Foreman +1 · Foreman +1

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.20.3 Foreman versions prior to 1.21.1 Foreman versions prior to 1.22.0 Description: The delete compute resource operation in Foreman, when executed from the Foreman API, can lead to the disclosure of the plaintext...

CVE-2018-14666

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions...

Authorization

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions...