Missing authorization in foreman katello plugin
Priority LOW 22CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Privilege escalation
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 2 fixed, 1 without a fix
Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862 and CWE-269.
Summary
A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.
Why it matters now
EPSS 0.00938 61st percentileScored 2026-11-07
Fix Partial katello (RubyGems): 3.17.0.rc1Red Hat: 1 advisoryRed Hat: 2 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Foreman Project | foreman katello plugin | 3.4.5 | — | No fix listed | CNA |
| — | katello (RubyGems) | before 3.17.0.rc1 | 3.17.0.rc1 | Patch available | GHSA-cpv6-pfq6-j2v7 |
- foreman katello plugin VendorThe Foreman Project Affected 3.4.5 Fixed in — No fix listed CNA
- katello (RubyGems) Vendor— Affected before 3.17.0.rc1 Fixed in 3.17.0.rc1 Patch available GHSA-cpv6-pfq6-j2v7
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:theforeman:katello:3.4.5:*:*:*:*:*:*:* | 3.4.5 | Vulnerable | The Foreman Project |
- cpe:2.3:a:theforeman:katello:3.4.5:*:*:*:*:*:*:* Versions 3.4.5 Vulnerable ·The Foreman Project
Remediation
- Fix · GHSA-cpv6-pfq6-j2v7 katello (RubyGems) Fixed in 3.17.0.rc1 Advisory →
Red Hat 1 advisory
- RHSA-2021:1313 Released 2021-04-21 · Red Hat rating ModerateSatellite 6.9 Release
- Red Hat Satellite 6.9 ansible-collection-redhat-satellite-2.0.1-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.1.0-1.el7sat +47
- Red Hat Satellite Capsule 6.9 ansible-collection-redhat-satellite-2.0.1-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.1.0-1.el7sat +47
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 1.3 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6.9 | Fixed | RHSA-2021:1313 |
| Red Hat Satellite Capsule 6.9 | Fixed | RHSA-2021:1313 |
Not affected: 2 products
- Red Hat Satellite 6.9
- Red Hat Satellite Capsule 6.9
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2662
- 2026-10-03 Alias added: GHSA-cpv6-pfq6-j2v7
References
Advisory 3
More The Foreman Project Katello vulnerabilities
- TI-2013-01912 The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not… CVSS 2.0MEDIUM 6.5
- TI-2012-03031 The installation script in Katello 1.0 and earlier does not properly generate the… CVSS 3.1CRITICAL 9.8
- TI-2013-03599 Katello has a Denial of Service vulnerability in API OAuth authentication CVSS 3.1HIGH 7.5
- TI-2016-07816 Link following in Foreman Project katello-debug CVSS 3.0HIGH 7.3
- TI-2018-12097 Cross-site scripting in katello CVSS 3.0MEDIUM 5.4
- TI-2013-01870 Katello has multiple XSS issues in various entities CVSS 3.1MEDIUM 5.4
Sources
- CVE-2017-2662 · CVE Program
- CVE-2017-2662 · NVD
- FIRST EPSS
- GHSA-cpv6-pfq6-j2v7 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-2662 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences