CVE-2016-7078: Infoleak
First published: Mon Sep 10 2018(Updated: )
foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Theforeman Foreman | =1.15.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/96385
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078
- https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905
- https://projects.theforeman.org/issues/16982
- https://seclists.org/oss-sec/2017/q1/470
- https://theforeman.org/security.html#2016-7078
Frequently Asked Questions
What is CVE-2016-7078?
CVE-2016-7078 is a vulnerability in the foreman software before version 1.15.0 that allows an information leak through the organizations and locations feature.
What is the severity of CVE-2016-7078?
The severity of CVE-2016-7078 is medium with a severity value of 4.3.
How does CVE-2016-7078 affect the foreman software?
CVE-2016-7078 affects the foreman software before version 1.15.0, allowing a user with no organizations/locations assigned to view all resources instead of none.
How can CVE-2016-7078 be fixed?
CVE-2016-7078 can be fixed by updating the foreman software to version 1.15.0 or later.
Where can I find more information about CVE-2016-7078?
More information about CVE-2016-7078 can be found at the following references: [SecurityFocus](http://www.securityfocus.com/bid/96385), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078), [GitHub](https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905).
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/theforeman
- canonical/theforeman foreman
- version/theforeman foreman/1.15.0