What is CVE-2013-2113?

CVE-2013-2113 is a vulnerability in Theforeman Foreman, classified under CWE-264. Published 2013-07-31.

Is CVE-2013-2113 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Theforeman Foreman

CVE-2013-2113

The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.

EPSS: 0.209 (97.3th percentile) — read the EPSS interpretation.

Affected products

Theforeman Foreman — versions 1.1
Redhat Openstack — versions 3.0
N/a — versions n/a

Weakness classification (CWE)

CWE-264

Public proof-of-concept exploits

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2013-2113?: CVE-2013-2113 is a vulnerability in Theforeman Foreman, classified under CWE-264. Published 2013-07-31.
Is CVE-2013-2113 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.