CVE-2016-7078 — Vulnetix

CVE-2016-7078 PUBLISHED CVSS 4.300000190734863 MEDIUM

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.

EPSS 0.32% · 55.0th percentile

Risk Scores

CVSS 3.0

4.300000190734863

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS Score

0.32%

55.0th percentile

Affected Products

Vendor	Product	Versions
theforeman	foreman	1.15.0
Foreman	foreman	1.15.0

Exploit Intelligence

CIRCL seen: CVE-2016-7078 (circl-sighting)
https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905 (circl)
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078 (circl)
96385 (circl)
https://theforeman.org/security.html#2016-7078 (circl)
https://projects.theforeman.org/issues/16982 (circl)
[oss-security] 20170222 CVE-2016-7078: Foreman organization/location authorization vulnerability (circl)

Timeline

Sep 10, 2018 CVE Published
Sep 10, 2018 PoC Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 13, 2022 CVE Updated
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Sep 3, 2022 EPSS Score
Oct 26, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 8, 2023 EPSS Score
Mar 7, 2023 EPSS Score

References

Open in Interactive Console →