CVE-2016-5390

Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
VendorProductVersion
theforemanforeman
1.11.0 ≤
𝑥
< 1.11.4
theforemanforeman
1.12.0 ≤
𝑥
< 1.12.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://projects.theforeman.org/issues/15653
http://www.securityfocus.com/bid/91770
https://bugzilla.redhat.com/show_bug.cgi?id=1355728
https://theforeman.org/security.html#2016-5390
http://projects.theforeman.org/issues/15653
http://www.securityfocus.com/bid/91770
https://bugzilla.redhat.com/show_bug.cgi?id=1355728
https://theforeman.org/security.html#2016-5390