CVE-2016-7077CWE-285

foreman before 1.14.0 is vulnerable to an information leak

Medium · published September 10, 2018

CVSS v3.0
4.3
EPSS
1%
Percentile
71.5
In the wild
Unconfirmed
What it is

foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01366 · 71.5th percentile
Weakness
CWE-285 · Improper Authorization
Published
2018-09-10T15:00Z
EPSS history
Timeline
  • 10 SEP 15:00Z
    foreman before 1.14.0 is vulnerable to an information leak
    cvelistv5