A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view and create templates to read any field from Foreman's database. By using specific strings in the loader macros, users can bypass permissions and access sensitive information.

An issue in templates related to loader macros which were introduced together with report templates. These allow an authenticated user having permission to view any of the resources which have loader macros and permissions to view and create (probably) any kind of templates that allows this user to read any field from Foreman's database by passing in strings to the loader macros and remapping fields from the result to the original object class.

Refer: https://github.com/theforeman/foreman/blob/da504c8a2599b325853066b5099493e0c

It was reported that the sessionid cookie in Foreman is set without the Secure flag. This may allow an attacker to perform a "session hijacking" attack.

Upstream bug: http://projects.theforeman.org/issues/10275 Proposed fix: https://github.com/theforeman/foreman/pull/2328

A cross-site scripting vulnerability was found in foreman in pages where facts are submitted through insertion of HTML in its name or value.

Upstream bug:

http://projects.theforeman.org/issues/21519

A flaw was found in foreman. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.

Upstream bug:

https://projects.theforeman.org/issues/22546

Upstream pull request:

https://github.com/theforeman/foreman/pull/5369

A vulnerability was discovered in the Foreman Remote Execution feature, allowing an unauthorized remote attacker to perform arbitrary code execution on managed hosts. The issue affects the component smartproxydynflow 0.1.8 and later (Foreman >= 1.15, Satellite >= 6.3)

Introducing commit:

https://github.com/theforeman/smartproxydynflow/commit/cb7b0b5c9b602f737ab4c6e9fb47c158241cf49c#diff-6dee70f4339cfc3dd8cedfc2a34f14c2

References:

https://bugzilla.redhat.com/showbug.cgi?id=1629003