REDHAT-BUG-2312524
First published: Mon Sep 16 2024(Updated: )
An issue in templates related to loader macros which were introduced together with report templates. These allow an authenticated user having permission to view any of the resources which have loader macros and permissions to view and create (probably) any kind of templates that allows this user to read any field from Foreman's database by passing in strings to the loader macros and remapping fields from the result to the original object class. Refer: <a href="https://github.com/theforeman/foreman/blob/da504c8a2599b325853066b5099493e0c">https://github.com/theforeman/foreman/blob/da504c8a2599b325853066b5099493e0c</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| The Foreman |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/theforeman/foreman/blob/da504c8a2599b325853066b5099493e0c
- https://access.redhat.com/errata/RHSA-2024:8717
- https://access.redhat.com/errata/RHSA-2024:8718
- https://access.redhat.com/errata/RHSA-2024:8719
- https://access.redhat.com/errata/RHSA-2024:8906
- https://bugzilla.redhat.com/show_bug.cgi?id=2312524
Frequently Asked Questions
What is the severity of REDHAT-BUG-2312524?
The severity of REDHAT-BUG-2312524 is categorized as moderate based on the risk it poses to affected systems.
How do I fix REDHAT-BUG-2312524?
To fix REDHAT-BUG-2312524, ensure you apply the latest patches and updates released by The Foreman.
Who is affected by REDHAT-BUG-2312524?
REDHAT-BUG-2312524 affects authenticated users of The Foreman who have permissions to view and create certain templates with loader macros.
What kind of templates are involved in REDHAT-BUG-2312524?
The templates involved in REDHAT-BUG-2312524 are those that utilize loader macros and can be viewed or created by authorized users.
Is authentication required to exploit REDHAT-BUG-2312524?
Yes, exploiting REDHAT-BUG-2312524 requires authentication as it involves user permissions related to templates.
- agent/severity
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-8553
- agent/last-modified-date
- agent/references
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/the foreman
- canonical/the foreman