CVE-2016-4451
Published Aug 19, 2016
Last updated 2 years ago
Overview
- Description
- The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.
- Source
- secalert@redhat.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.0
- Type
- Primary
- Base score
- 5
- Impact score
- 3.4
- Exploitability score
- 1.6
- Vector string
- CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
- Severity
- MEDIUM
CVSS 2.0
- Type
- Primary
- Base score
- 6
- Impact score
- 6.4
- Exploitability score
- 6.8
- Vector string
- AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-254
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8B913B1D-1FAB-4865-9E87-69B22C3B91B9",
"versionEndIncluding": "1.11.2"
},
{
"criteria": "cpe:2.3:a:theforeman:foreman:1.12.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2D1166A-4EAE-40B2-8F85-1FA23C3949E2"
}
],
"operator": "OR"
}
]
}
]