CVE-2016-2100 Missing authorization in n/a

What is CVE-2016-2100?

CVE-2016-2100 is a medium-severity missing authorization vulnerability in Theforeman Foreman, published on 20 May 2016. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission.

Weakness: CWE-284

Which versions are affected by CVE-2016-2100?

It affects 1 product.

Products include Theforeman Foreman.

How do I fix CVE-2016-2100?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2016-2100 being exploited?

There is no known exploitation of CVE-2016-2100 in the wild and no public exploit code.

Other vulnerabilities in Theforeman Foreman

• CVE-2018-14643 smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature Critical 9.8
• CVE-2017-7505 Missing authorization in foreman High 8.8
• CVE-2016-4475 Missing authorization in n/a High 8.8
• CVE-2016-3728 Code injection in n/a High 8.8
• CVE-2015-5246 Auth bypass in n/a High 8.1

All Theforeman Foreman vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2015-7582, GHSA-96w5-w762-fpvr.