CVE-2021-20290
First published: Tue Mar 16 2021(Updated: )
An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Theforeman Openscap | <0.9.1 | |
| redhat/smart_proxy_openscap | <0.9.1 | 0.9.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-20290?
CVE-2021-20290 is an improper authorization handling flaw in Foreman that allows authenticated local attackers to access and delete limited resources.
How does CVE-2021-20290 affect Foreman?
CVE-2021-20290 allows foreman clients to execute actions that should be limited to the Foreman Server.
What is the severity of CVE-2021-20290?
CVE-2021-20290 has a severity level of 6.1 (medium).
How can CVE-2021-20290 be fixed?
To fix CVE-2021-20290, update to version 0.9.1 or later of the smart_proxy_openscap package.
Where can I find more information about CVE-2021-20290?
You can find more information about CVE-2021-20290 in the references provided: [Link 1](https://github.com/theforeman/smart_proxy_openscap/pull/80) and [Link 2](https://bugzilla.redhat.com/show_bug.cgi?id=1939701).
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-20290
- agent/software-canonical-lookup
- agent/tags
- agent/trending
- vendor/theforeman
- canonical/theforeman openscap
- package-manager/redhat