A flaw was found in Katello. The Flatpak Remote Repositories API resolves records with an unscoped FlatpakRemoteRepository.find in a beforeaction used by show and mirror, while the index path correctly uses FlatpakRemoteRepository.readable. An authenticated user with viewflatpakremotes in one organization can read another organization's flatpak remote repository metadata. The same unscoped finder backs the mirror action, which creates a repository in a product the attacker can edit using the victim organization's flatpak remote registry URL and stored remote credentials (username/token). Reported via PSIRTSUPT-25121.

A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view and create templates to read any field from Foreman's database. By using specific strings in the loader macros, users can bypass permissions and access sensitive information.

An issue in templates related to loader macros which were introduced together with report templates. These allow an authenticated user having permission to view any of the resources which have loader macros and permissions to view and create (probably) any kind of templates that allows this user to read any field from Foreman's database by passing in strings to the loader macros and remapping fields from the result to the original object class.

Refer: https://github.com/theforeman/foreman/blob/da504c8a2599b325853066b5099493e0c

A vulnerability was discovered in the Foreman Remote Execution feature, allowing an unauthorized remote attacker to perform arbitrary code execution on managed hosts. The issue affects the component smartproxydynflow 0.1.8 and later (Foreman >= 1.15, Satellite >= 6.3)

Introducing commit:

https://github.com/theforeman/smartproxydynflow/commit/cb7b0b5c9b602f737ab4c6e9fb47c158241cf49c#diff-6dee70f4339cfc3dd8cedfc2a34f14c2

References:

https://bugzilla.redhat.com/showbug.cgi?id=1629003

A flaw was found in foreman. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.

Upstream bug:

https://projects.theforeman.org/issues/22546

Upstream pull request:

https://github.com/theforeman/foreman/pull/5369

A cross-site scripting vulnerability was found in foreman in pages where facts are submitted through insertion of HTML in its name or value.

Upstream bug:

http://projects.theforeman.org/issues/21519

It was reported that the sessionid cookie in Foreman is set without the Secure flag. This may allow an attacker to perform a "session hijacking" attack.

Upstream bug: http://projects.theforeman.org/issues/10275 Proposed fix: https://github.com/theforeman/foreman/pull/2328