It was found that the foreman API and UI actions and URLs are not properly limited to the organizations and locations they were assigned to. This could allow an attacker to view and update other organizations and locations in the system that they should not be allowed to.
Find out more about CVE-2016-4475 from the MITRE CVE dictionary dictionary and NIST NVD.
| Base Score | 4.9 |
|---|---|
| Base Metrics | AV:N/AC:M/Au:S/C:P/I:P/A:N |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | Single |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | None |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Satellite Capsule 6.2 (foreman) | RHBA-2016:1615 | 2016-08-16 |
| Red Hat Satellite 6.2 (foreman) | RHBA-2016:1615 | 2016-08-16 |
| Red Hat Satellite Capsule 6.1 (foreman) | RHBA-2016:1615 | 2016-08-16 |
| Red Hat Satellite 6.1 - Optional (foreman) | RHBA-2016:1615 | 2016-08-16 |
| Platform | Package | State |
|---|---|---|
| Red Hat Satellite 6 | foreman | Will not fix |
| Red Hat Ceph Storage 1.3 | foreman | Will not fix |
| OpenStack 6 Installer for RHEL 7 | foreman | Will not fix |
Vulmon