CVE-2016-4475

Impact:
Moderate
Public Date:
2016-06-02
CWE:
CWE-284
Bugzilla:
1342439: CVE-2016-4475 foreman: API and UI actions/URLs not limited to the orgs/locations assigned
It was found that the foreman API and UI actions and URLs are not properly limited to the organizations and locations they were assigned to. This could allow an attacker to view and update other organizations and locations in the system that they should not be allowed to.

Find out more about CVE-2016-4475 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 4.9
Base Metrics AV:N/AC:M/Au:S/C:P/I:P/A:N
Access Vector Network
Access Complexity Medium
Authentication Single
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Satellite Capsule 6.2 (foreman) RHBA-2016:1615 2016-08-16
Red Hat Satellite 6.2 (foreman) RHBA-2016:1615 2016-08-16
Red Hat Satellite Capsule 6.1 (foreman) RHBA-2016:1615 2016-08-16
Red Hat Satellite 6.1 - Optional (foreman) RHBA-2016:1615 2016-08-16

Affected Packages State

Platform Package State
Red Hat Satellite 6 foreman Will not fix
Red Hat Ceph Storage 1.3 foreman Will not fix
OpenStack 6 Installer for RHEL 7 foreman Will not fix
Last Modified