REDHAT-BUG-2312524: Medium severity the foreman vulnerability
An issue in templates related to loader macros which were introduced together with report templates. These allow an authenticated user having permission to view any of the resources which have loader macros and permissions to view and create (probably) any kind of templates that allows this user to read any field from Foreman's database by passing in strings to the loader macros and remapping fields from the result to the original object class.
Refer: https://github.com/theforeman/foreman/blob/da504c8a2599b325853066b5099493e0c
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2312524?
The severity of REDHAT-BUG-2312524 is categorized as moderate based on the risk it poses to affected systems.
How do I fix REDHAT-BUG-2312524?
To fix REDHAT-BUG-2312524, ensure you apply the latest patches and updates released by The Foreman.
Who is affected by REDHAT-BUG-2312524?
REDHAT-BUG-2312524 affects authenticated users of The Foreman who have permissions to view and create certain templates with loader macros.
What kind of templates are involved in REDHAT-BUG-2312524?
The templates involved in REDHAT-BUG-2312524 are those that utilize loader macros and can be viewed or created by authorized users.
Is authentication required to exploit REDHAT-BUG-2312524?
Yes, exploiting REDHAT-BUG-2312524 requires authentication as it involves user permissions related to templates.