Authentication flaw

Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API...

CVE-2015-3155

Foreman before 1.8.1 does not set the secure flag for the sessionid cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2015-3235

Foreman before 1.9.0 allows remote authenticated users with the editusers permission to edit administrator users and change their passwords via unspecified vectors...

CVE-2015-1844

Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API...

CVE-2015-3235

CVE-2015-3235 affects Foreman within Red Hat Satellite (Foreman-based) where users with the edit_users permission can edit admin user passwords, enabling privilege escalation. Connected sources corroborate the issue as part of Foreman/Satellite advisories and Veracode summaries tying the CVE to F...

CVE-2015-3155

Foreman vulnerable: Foreman before 1.8.1 does not set the secure flag on the _session_id cookie in HTTPS sessions, enabling cookie capture over HTTP. Impact is partial confidentiality loss. Remediation: update to Foreman 1.8.1 or later (fixes the secure flag handling).

CVE-2015-1844

CVE-2015-1844 corresponds to a Foreman/Satellite API authorization flaw: remote authenticated users could bypass organization/location restrictions via the REST API. Connected advisories (RHSA-2015:1591/1592) indicate affected Foreman components and that remediation is provided through Red Hat Sa...

PT-2015-6112 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.9.0 Description: The issue allows remote authenticated users with the edit users permission to edit administrator users and change their passwords. An attacker with the edit users permission could use this flaw to...

PT-2015-6081 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.8.1 Description: The issue makes it easier for remote attackers to capture the session id cookie by intercepting its transmission within an http session, as the secure flag is not set for this cookie in an https...

rhn_satellite_6: cross-site request forgery (CSRF) can force logout

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content...

foreman: cross-site scripting (XSS) flaw in template preview screen

A cross-site scripting XSS flaw was found in Foreman's template preview screen. A remote attacker could use this flaw to perform cross-site scripting attacks by tricking a user into viewing a malicious template. Note that templates are commonly shared among users...

foreman: edit_users permission allows changing of admin passwords

It was discovered that in Foreman the editusers permissions for example, granted to the Manager role allowed the user to edit admin user passwords. An attacker with the editusers permissions could use this flaw to access an admin user account, leading to an escalation of privileges...

foreman: the _session_id cookie is issued without the Secure flag

It was found that Foreman did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...

foreman: lack of SSL certificate validation when performing LDAPS authentication

It was found that when making an SSL connection to an LDAP authentication source in Foreman, the remote server certificate was accepted without any verification against known certificate authorities, potentially making TLS connections vulnerable to man-in-the-middle attacks...

foreman: cross-site scripting (XSS) flaw in template preview screen

A cross-site scripting XSS flaw was found in Foreman's template preview screen. A remote attacker could use this flaw to perform cross-site scripting attacks by tricking a user into viewing a malicious template. Note that templates are commonly shared among users...

foreman: edit_users permission allows changing of admin passwords

It was discovered that in Foreman the editusers permissions for example, granted to the Manager role allowed the user to edit admin user passwords. An attacker with the editusers permissions could use this flaw to access an admin user account, leading to an escalation of privileges...

foreman: lack of SSL certificate validation when performing LDAPS authentication

It was found that when making an SSL connection to an LDAP authentication source in Foreman, the remote server certificate was accepted without any verification against known certificate authorities, potentially making TLS connections vulnerable to man-in-the-middle attacks...

foreman: the _session_id cookie is issued without the Secure flag

It was found that Foreman did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...

Cross site scripting

Cross-site scripting XSS vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template...

CVE-2014-3653

Cross-site scripting XSS vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template...