CVE-2019-3893

foreman: Recover of plaintext password or token for the compute resources

Published Apr 9, 2019 CVSS 3.1 · 4.9 Medium EPSS 1.8% KEV · Not listed
Description
In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2019-13502 In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.01349}

epss

{'score': 0.01281}

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 4, 2024, 7:19 PM
Reserved
Jan 3, 2019, 12:00 AM
Status
Modified
Published
Apr 9, 2019, 4:29 PM
Modified
Jun 17, 2026, 2:35 AM
Severity
Moderate
Public date
Apr 9, 2019, 3:01 AM