VDB
CVE-2021-3494
CVE-2021-3494
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0.
EPSS 0.37% · 30.5th percentile
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.37%
30.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | foreman | foreman 2.5.0 |
| theforeman | foreman | 0 |
Timeline
- Apr 26, 2021 CVE Published
- Apr 27, 2021 EPSS Score
- Jul 1, 2021 EPSS Score
- Sep 2, 2021 EPSS Score
- Nov 4, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Mar 10, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 12, 2022 EPSS Score
- Jul 15, 2022 EPSS Score
- Sep 16, 2022 EPSS Score
- Nov 18, 2022 EPSS Score