CVE-2015-5233: Medium severity the foreman vulnerability
Dominic Cleal of the Red Hat Satellite Team reports:
Reports (from tools such as Puppet) are stored in Foreman and associated to the host they came from. Users can be granted permissions to view and/or destroy reports, and also separate permissions to view certain hosts. The UI and API only list reports where the user has permission to view both reports and the host it was from.
The security issue is that both the show and destroy actions for viewing and deleting individual reports do not limit access to the hosts that the user has permission to view. A user with permission to view or destroy reports can do so for any host if they know the ID, or can easily view the last report for a given host.
External Reference: http://projects.theforeman.org/issues/11579
Other sources
Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply viewhosts permissions, which allows (1) remote authenticated users with the viewreports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroyreports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5233?
CVE-2015-5233 has a medium severity rating due to improper permission handling allowing unauthorized access to reports.
How do I fix CVE-2015-5233?
To fix CVE-2015-5233, upgrade Foreman to version 1.8.4 or later, or 1.9.1 or later.
Who is affected by CVE-2015-5233?
CVE-2015-5233 affects users of Foreman versions before 1.8.4 and 1.9.0, as well as Red Hat Satellite 6.1.
What are the risks of CVE-2015-5233?
The risks of CVE-2015-5233 include unauthorized users being able to read or delete sensitive reports from other hosts.
Is there a workaround for CVE-2015-5233?
There is no official workaround for CVE-2015-5233, and the only solution is to update to the fixed versions.