Read the docs

The Foreman Project

Records108All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high36CVSS 7.0–8.9

Exploited now

The Foreman Project records in CISA KEV

No The Foreman Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Foreman 86 records HIGH Katello 10 records MEDIUM Foreman Ansible 2 records LOW Hammer Cli 2 records LOW Foreman-tasks 1 record LOW Foreman Azurerm 1 record LOW Foremanfogproxmox 1 record LOW Kafo 1 record LOW

Records

10 records in Katello · all components

TI-2013-01912 CVE-2013-2143 · GHSA-rhwm-66gm-6j9v

The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not…

Priority MEDIUM 59

The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.48221 Published 2014-04-17 Will not fix CWE-20
TI-2012-03031 CVE-2012-3503 · GHSA-5xv2-q475-rwrh

The installation script in Katello 1.0 and earlier does not properly generate the…

Priority MEDIUM 48

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers t…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03002 Published 2012-08-25 Fixed in 1.0.6, 1.1.7 CWE-798
TI-2016-07816 CVE-2016-9595 · GHSA-4fx8-jx6v-vjhj

Link following in Foreman Project katello-debug

Priority LOW 32

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files.

CVSS 3.0HIGH 7.3 Local Low privileges User interaction EPSS 0.00403 Published 2018-07-27 Fixed CWE-377
TI-2018-12097 CVE-2018-16887 · GHSA-mhhc-r88h-2qrm

Cross-site scripting in katello

Priority LOW 26

A cross-site scripting (XSS) flaw was found in the katello component of Satellite.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00999 Published 2019-01-13 Fixed in 3.9.0 CWE-79
TI-2017-01908 CVE-2017-2662 · GHSA-cpv6-pfq6-j2v7

Missing authorization in foreman katello plugin

Priority LOW 22

A flaw was found in Foreman's katello plugin version 3.4.5.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00938 Published 2018-08-22 Partial fix · 3.17.0.rc1 CWE-862
Open these records in search →