REDHAT-BUG-2523348: Medium severity Katello vulnerability
An authorization bypass in Katello's Content View History API. The ContentViewHistoriesController resolves the requested Content View using an unrestricted ContentView.find(params[:contentviewid]) lookup instead of the authorization-aware ContentView.readable scope. As a result, an authenticated user with viewcontentviews permission for one organization may be able to supply the ID of a Content View belonging to another organization and retrieve its lifecycle history. The reported impact is limited to unauthorized disclosure of Content View lifecycle metadata, including publication and promotion events, associated users, and timestamps.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated and have view_content_views permission for at least one organization. They may then be able to request the ID of a Content View in another organization.
What information could be exposed?
The exposure is limited to Content View lifecycle metadata. This includes publication and promotion events, associated users, and timestamps.
How can an organization assess whether it may be affected?
Review whether users with view_content_views permission in one organization can submit Content View History API requests using Content View IDs owned by another organization. Successful retrieval of lifecycle history across organization boundaries indicates exposure.