CVE-2017-7505
First published: Fri May 26 2017(Updated: )
Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| The Foreman | =1.5.0 | |
| The Foreman | =1.5.0-rc1 | |
| The Foreman | =1.5.0-rc2 | |
| The Foreman | =1.5.1 | |
| The Foreman | =1.5.2 | |
| The Foreman | =1.5.3 | |
| The Foreman | =1.6.0 | |
| The Foreman | =1.6.0-rc1 | |
| The Foreman | =1.6.0-rc2 | |
| The Foreman | =1.6.1 | |
| The Foreman | =1.6.3 | |
| The Foreman | =1.7.0 | |
| The Foreman | =1.7.0-rc1 | |
| The Foreman | =1.7.0-rc2 | |
| The Foreman | =1.7.1 | |
| The Foreman | =1.7.2 | |
| The Foreman | =1.7.3 | |
| The Foreman | =1.7.4 | |
| The Foreman | =1.7.5 | |
| The Foreman | =1.8.0 | |
| The Foreman | =1.8.0-rc1 | |
| The Foreman | =1.8.0-rc2 | |
| The Foreman | =1.8.0-rc3 | |
| The Foreman | =1.8.1 | |
| The Foreman | =1.8.2 | |
| The Foreman | =1.8.3 | |
| The Foreman | =1.8.4 | |
| The Foreman | =1.9.0 | |
| The Foreman | =1.9.0-rc1 | |
| The Foreman | =1.9.0-rc2 | |
| The Foreman | =1.9.0-rc3 | |
| The Foreman | =1.9.1 | |
| The Foreman | =1.9.2 | |
| The Foreman | =1.9.3 | |
| The Foreman | =1.10.0 | |
| The Foreman | =1.10.0-rc1 | |
| The Foreman | =1.10.0-rc2 | |
| The Foreman | =1.10.0-rc3 | |
| The Foreman | =1.10.1 | |
| The Foreman | =1.10.2 | |
| The Foreman | =1.10.3 | |
| The Foreman | =1.10.4 | |
| The Foreman | =1.11.0 | |
| The Foreman | =1.11.0-rc1 | |
| The Foreman | =1.11.0-rc2 | |
| The Foreman | =1.11.0-rc3 | |
| The Foreman | =1.11.1 | |
| The Foreman | =1.11.2 | |
| The Foreman | =1.11.3 | |
| The Foreman | =1.11.4 | |
| The Foreman | =1.12.0 | |
| The Foreman | =1.12.0-rc1 | |
| The Foreman | =1.12.0-rc2 | |
| The Foreman | =1.12.0-rc3 | |
| The Foreman | =1.12.1 | |
| The Foreman | =1.12.2 | |
| The Foreman | =1.12.3 | |
| The Foreman | =1.12.4 | |
| The Foreman | =1.13.0 | |
| The Foreman | =1.13.0-rc1 | |
| The Foreman | =1.13.0-rc2 | |
| The Foreman | =1.13.1 | |
| The Foreman | =1.13.2 | |
| The Foreman | =1.13.3 | |
| The Foreman | =1.13.4 | |
| The Foreman | =1.14.0 | |
| The Foreman | =1.14.0-rc1 | |
| The Foreman | =1.14.0-rc2 | |
| The Foreman | =1.14.0-rc3 | |
| The Foreman | =1.14.1 | |
| The Foreman | =1.14.2 | |
| The Foreman | =1.14.3 | |
| The Foreman | =1.15.0 | |
| The Foreman | =1.15.0-rc1 | |
| The Foreman | =1.15.0-rc2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-7505?
CVE-2017-7505 is rated as a medium severity vulnerability due to the potential for unauthorized access to administrator-level functionalities.
How do I fix CVE-2017-7505?
To fix CVE-2017-7505, update Forsman to version 1.15 or later, which addresses the incorrect authorization check.
What versions are affected by CVE-2017-7505?
CVE-2017-7505 affects Foreman versions ranging from 1.5.0 to 1.14.3.
Can CVE-2017-7505 allow unauthorized actions on administrator user objects?
Yes, CVE-2017-7505 enables users with specific permissions to perform unauthorized actions on administrator user objects outside their scope.
Is CVE-2017-7505 a critical vulnerability?
CVE-2017-7505 is not classified as critical but poses significant risks of unauthorized access to sensitive administrative actions.
- agent/weakness
- agent/type
- agent/remedy
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/theforeman
- canonical/the foreman
- version/the foreman/1.5.0
- version/the foreman/1.5.0-rc1
- version/the foreman/1.5.0-rc2
- version/the foreman/1.5.1
- version/the foreman/1.5.2
- version/the foreman/1.5.3
- version/the foreman/1.6.0
- version/the foreman/1.6.0-rc1
- version/the foreman/1.6.0-rc2
- version/the foreman/1.6.1
- version/the foreman/1.6.3
- version/the foreman/1.7.0
- version/the foreman/1.7.0-rc1
- version/the foreman/1.7.0-rc2
- version/the foreman/1.7.1
- version/the foreman/1.7.2
- version/the foreman/1.7.3
- version/the foreman/1.7.4
- version/the foreman/1.7.5
- version/the foreman/1.8.0
- version/the foreman/1.8.0-rc1
- version/the foreman/1.8.0-rc2
- version/the foreman/1.8.0-rc3
- version/the foreman/1.8.1
- version/the foreman/1.8.2
- version/the foreman/1.8.3
- version/the foreman/1.8.4
- version/the foreman/1.9.0
- version/the foreman/1.9.0-rc1
- version/the foreman/1.9.0-rc2
- version/the foreman/1.9.0-rc3
- version/the foreman/1.9.1
- version/the foreman/1.9.2
- version/the foreman/1.9.3
- version/the foreman/1.10.0
- version/the foreman/1.10.0-rc1
- version/the foreman/1.10.0-rc2
- version/the foreman/1.10.0-rc3
- version/the foreman/1.10.1
- version/the foreman/1.10.2
- version/the foreman/1.10.3
- version/the foreman/1.10.4
- version/the foreman/1.11.0
- version/the foreman/1.11.0-rc1
- version/the foreman/1.11.0-rc2
- version/the foreman/1.11.0-rc3
- version/the foreman/1.11.1
- version/the foreman/1.11.2
- version/the foreman/1.11.3
- version/the foreman/1.11.4
- version/the foreman/1.12.0
- version/the foreman/1.12.0-rc1
- version/the foreman/1.12.0-rc2
- version/the foreman/1.12.0-rc3
- version/the foreman/1.12.1
- version/the foreman/1.12.2
- version/the foreman/1.12.3
- version/the foreman/1.12.4
- version/the foreman/1.13.0
- version/the foreman/1.13.0-rc1
- version/the foreman/1.13.0-rc2
- version/the foreman/1.13.1
- version/the foreman/1.13.2
- version/the foreman/1.13.3
- version/the foreman/1.13.4
- version/the foreman/1.14.0
- version/the foreman/1.14.0-rc1
- version/the foreman/1.14.0-rc2
- version/the foreman/1.14.0-rc3
- version/the foreman/1.14.1
- version/the foreman/1.14.2
- version/the foreman/1.14.3
- version/the foreman/1.15.0
- version/the foreman/1.15.0-rc1
- version/the foreman/1.15.0-rc2