CVE-2016-7077 Missing authorization in foreman
Unauthorized users can view names of associated objects in Foreman due to missing authorization checks in form helpers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7077?
CVE-2016-7077 is a medium-severity missing authorization vulnerability in Theforeman Foreman, published on 10 Sep 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.
Which versions are affected by CVE-2016-7077?
It affects 1 product.
Products include Theforeman Foreman.
How do I fix CVE-2016-7077?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2016-7077 being exploited?
There is no known exploitation of CVE-2016-7077 in the wild and no public exploit code.
Other vulnerabilities in Theforeman Foreman
Sources
Also known as GHSA-qw4f-j9p2-3626.