REDHAT-BUG-1262443: Medium severity foreman vulnerability
Dominic Cleal of the Red Hat Satellite Team reports:
Reports (from tools such as Puppet) are stored in Foreman and associated to the host they came from. Users can be granted permissions to view and/or destroy reports, and also separate permissions to view certain hosts. The UI and API only list reports where the user has permission to view both reports and the host it was from.
The security issue is that both the show and destroy actions for viewing and deleting individual reports do not limit access to the hosts that the user has permission to view. A user with permission to view or destroy reports can do so for any host if they know the ID, or can easily view the last report for a given host.
External Reference: http://projects.theforeman.org/issues/11579
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1262443?
The severity of REDHAT-BUG-1262443 is considered high due to potential unauthorized access to sensitive reports.
How do I fix REDHAT-BUG-1262443?
To fix REDHAT-BUG-1262443, ensure that proper permissions are assigned for viewing and managing reports in Foreman.
What software is affected by REDHAT-BUG-1262443?
REDHAT-BUG-1262443 affects the Red Hat Foreman software.
What are the potential risks associated with REDHAT-BUG-1262443?
The potential risks include unauthorized users gaining access to sensitive reports and possibly altering or deleting them.
Is there a workaround for REDHAT-BUG-1262443?
A temporary workaround for REDHAT-BUG-1262443 includes restricting user permissions until an official patch is applied.