CVE-2014-8183

foreman: models with a 'belongs_to' association to an Organization do not verify association belongs to that Organization

Published Aug 1, 2019 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Description
It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2014-8024 It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 1:10 PM
Reserved
Oct 10, 2014, 12:00 AM
Status
Modified
Published
Aug 1, 2019, 2:15 PM
Modified
Jun 17, 2026, 12:16 AM
Severity
Moderate
Public date
Aug 14, 2017, 12:00 AM