Privilege escalation in Theforeman Foreman
CVE-2017-2672
A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to access those systems.
EPSS: 0.012 (65.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Theforeman Foreman
- [Unknown] Foreman — versions foreman 1.15
- Redhat Satellite — versions 6.3
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2017-2672?
- CVE-2017-2672 is a medium-severity vulnerability in Theforeman Foreman, classified under Cleartext Storage of Sensitive Information. CVSS score: 6.5/10. Published 2018-06-21.
- How severe is CVE-2017-2672?
- Medium severity. CVSS v3 base score is 6.5 out of 10.