Authorization Bypass

2020-08-0400:50:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

68.4%

JSON

foreman is vulnerable to authorization bypass. The access to provisioning template previews is not properly restricted, allowing remote attackers to obtain confidential information via the hostname parameter.

CPENameOperatorVersion
jboss-jaxb-api_2.2_speceq1.0.4__1.Final_redhat_1.1.ep6.el6
ruby193-rubygem-apipie-paramseq0.0.2__2.el6_4
ruby193-rubygem-loggingeq1.8.1__7.el6_4
ruby193-rubygem-loggingeq1.6.2__1.el6cf
rubygem-gssapieq1.1.2__3.el6sat
rubygem-gssapieq1.1.2__2.el6
rubygem-gssapieq1.1.2__3.el7
rubygem-thoreq0.14.6__2.el6_0
rubygem-thoreq0.14.6__3.el6
rubygem-thoreq0.14.6__2.el6op

Name	Operator	Version
jboss-jaxb-api_2.2_spec	eq	1.0.4__1.Final_redhat_1.1.ep6.el6
ruby193-rubygem-apipie-params	eq	0.0.2__2.el6_4
ruby193-rubygem-logging	eq	1.8.1__7.el6_4
ruby193-rubygem-logging	eq	1.6.2__1.el6cf
rubygem-gssapi	eq	1.1.2__3.el6sat
rubygem-gssapi	eq	1.1.2__2.el6
rubygem-gssapi	eq	1.1.2__3.el7
rubygem-thor	eq	0.14.6__2.el6_0
rubygem-thor	eq	0.14.6__3.el6
rubygem-thor	eq	0.14.6__2.el6op