CVE-2014-0192: Medium severity theforeman foreman vulnerability
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."
Other sources
Ohad Levy of Red Hat reports:
since 1e0fd283 it is possible to override spoof by providing a hostname parameters.
this would allow to retrieve any template of any host bypassing authentication.
External references: http://projects.theforeman.org/issues/5436 http://projects.theforeman.org/projects/foreman/repository/revisions/1e0fd283180dc6bda30c880898cdea69cb579194
Fixed in: https://github.com/theforeman/foreman/pull/1404 https://github.com/theforeman/foreman/commit/aa0ebe8
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0192?
CVE-2014-0192 has a medium severity rating due to its ability to expose sensitive information.
How do I fix CVE-2014-0192?
To fix CVE-2014-0192, upgrade Foreman to version 1.5.0 or later.
What versions are affected by CVE-2014-0192?
CVE-2014-0192 affects Foreman versions 1.4.0 through 1.4.4.
Can CVE-2014-0192 be exploited?
Yes, CVE-2014-0192 can be exploited by remote attackers to gain sensitive information.
Is there a workaround for CVE-2014-0192 before upgrading?
There are no known workarounds for CVE-2014-0192 other than upgrading to a fixed version.