CVE-2023-4886

A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.7 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
redhatCNA
6.7 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
VendorProductVersion
theforemanforeman
𝑥
< 3.8.0
redhatsatellite
6.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2023:7851
https://access.redhat.com/errata/RHSA-2024:1061
https://access.redhat.com/security/cve/CVE-2023-4886
https://bugzilla.redhat.com/show_bug.cgi?id=2230135
https://access.redhat.com/errata/RHSA-2023:7851
https://access.redhat.com/errata/RHSA-2024:1061
https://access.redhat.com/security/cve/CVE-2023-4886
https://bugzilla.redhat.com/show_bug.cgi?id=2230135