CVE-2016-7078 Missing authorization in foreman
Users with no assigned organizations or locations can view all resources, bypassing intended visibility restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7078?
CVE-2016-7078 is a medium-severity missing authorization vulnerability in Theforeman Foreman, published on 10 Sep 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.
Which versions are affected by CVE-2016-7078?
It affects 1 product.
Products include Theforeman Foreman.
How do I fix CVE-2016-7078?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2016-7078 being exploited?
There is no known exploitation of CVE-2016-7078 in the wild and no public exploit code.
Other vulnerabilities in Theforeman Foreman
Sources
Also known as GHSA-c2qx-mg67-hwxr.