CVE-2016-7078CWE-285

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature

Medium · published September 10, 2018

CVSS v3.0
4.3
EPSS
1%
Percentile
71.3
In the wild
Unconfirmed
What it is

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01360 · 71.3th percentile
Weakness
CWE-285 · Improper Authorization
Published
2018-09-10T15:00Z
EPSS history
Timeline
  • 10 SEP 15:00Z
    foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature
    cvelistv5