CVE-2021-3469CWE-863

Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw

published June 3, 2021

CVSS
—
EPSS
0%
Percentile
25.1
In the wild
Unconfirmed
What it is

Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00331 · 25.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2021-06-03T19:43Z
EPSS history
Timeline
  • 03 JUN 19:43Z
    Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw
    cvelistv5