Improper authorization in rubygem-foreman_ansible
Priority LOW 30CWE-285Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-285.
Summary
A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4.
Why it matters now
EPSS 0.00768 55th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | rubygem-foreman_ansible | tfm-rubygem-foreman_ansible 4.0.3.4 | — | No fix listed | CNA |
- rubygem-foreman_ansible Vendor— Affected tfm-rubygem-foreman_ansible 4.0.3.4 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:satellite:6.7:*:*:*:*:*:*:* | 6.7 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:satellite_capsule:6.7:*:*:*:*:*:*:* | 6.7 | Vulnerable | Red Hat |
| cpe:2.3:a:theforeman:foreman_ansible:*:*:*:*:*:ruby:*:* | before 4.0.3.4 | Vulnerable | The Foreman Project |
- cpe:2.3:a:redhat:satellite:6.7:*:*:*:*:*:*:* Versions 6.7 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:satellite_capsule:6.7:*:*:*:*:*:*:* Versions 6.7 Vulnerable ·Red Hat
- cpe:2.3:a:theforeman:foreman_ansible:*:*:*:*:*:ruby:*:* Versions before 4.0.3.4 Vulnerable ·The Foreman Project
Remediation
Red Hat 1 advisory
- RHSA-2020:1454 Released 2020-04-14 · Red Hat rating ImportantSatellite 6.7 release.
- Red Hat Satellite 6.7 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.7.1-1.el7sat +47
- Red Hat Satellite Capsule 6.7 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.7.1-1.el7sat +47
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6.7 | Fixed | RHSA-2020:1454 |
| Red Hat Satellite Capsule 6.7 | Fixed | RHSA-2020:1454 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-10716
- 2026-10-03 Alias added: GHSA-w5v4-7h7x-xfvq
References
Sources
- CVE-2020-10716 · CVE Program
- CVE-2020-10716 · NVD
- FIRST EPSS
- GHSA-w5v4-7h7x-xfvq · GitHub Advisory Database · CC BY 4.0
- CVE-2020-10716 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences