CVE-2023-4886: Foreman: world readable file containing secrets
A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.
Other sources
On Foreman, the file /etc/tomcat/server.xml is created as world readable exposing sensitive information. The impact of this flaw is limited to highly privileged users.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-4886?
CVE-2023-4886 is a sensitive information exposure vulnerability found in foreman.
What is the severity of CVE-2023-4886?
The severity of CVE-2023-4886 is medium with a CVSS score of 4.4.
How does CVE-2023-4886 affect foreman?
CVE-2023-4886 affects foreman by exposing sensitive information such as passwords to candlepin's keystore and truststore.
Which versions of foreman are affected by CVE-2023-4886?
Versions up to and excluding 3.8.0 of foreman are affected by CVE-2023-4886.
Is there a fix available for CVE-2023-4886?
Yes, a fix for CVE-2023-4886 is available and it can be found in version 3.8.0 of foreman.