CVE-2016-7078: Infoleak
foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned no organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-7078?
CVE-2016-7078 is a vulnerability in the foreman software before version 1.15.0 that allows an information leak through the organizations and locations feature.
What is the severity of CVE-2016-7078?
The severity of CVE-2016-7078 is medium with a severity value of 4.3.
How does CVE-2016-7078 affect the foreman software?
CVE-2016-7078 affects the foreman software before version 1.15.0, allowing a user with no organizations/locations assigned to view all resources instead of none.
How can CVE-2016-7078 be fixed?
CVE-2016-7078 can be fixed by updating the foreman software to version 1.15.0 or later.
Where can I find more information about CVE-2016-7078?
More information about CVE-2016-7078 can be found at the following references: [SecurityFocus](http://www.securityfocus.com/bid/96385), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078), [GitHub](https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905).